MongoliaLaw on Protection of Personal Data, enforcement
Law on Protection of Personal Data (), Arts. 24-26, 28, 30
In force since .
An enforcement supervision rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- An app processing Mongolian personal data may be investigated by a designated National Human Rights Commission member or the state digital-development and communications body, and a person may complain to either, with a further court appeal available. Fines and criminal penalties sit in the separate Law on Violations and Criminal Law, neither of which is confirmed here; a general damages-and-rights-protection remedy exists at Art. 16.2, though it is not framed as a dedicated statutory cause of action.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Which body is the "эрх бүхий байгууллага" ("competent authority") that Article 28.2 names, together with the National Human Rights Commission, as the place to complain about a controller other than a state body?
What it makes you log
Logging duty
Articles 24 to 26, 28 and 30 set the powers of the National Human Rights Commission and the ministry body, other state bodies' supervision within their functions, complaint routes and liability. They put no log, register or record duty on a controller. The Commission supervises implementation and may investigate on a complaint or on its own initiative (Article 24.1.1 and 24.1.2), a power it exercises at its own discretion, so the audit is on request, performed by the regulator, with no report owed by the controller. Article 24.1.4 has the Commission review the records of response measures controllers submit; the duty to keep and deliver them is in Article 22.5 and 22.6 and is coded on the breach row. Article 27.8 (inspection of recording systems) is outside the cited articles.
- Kind
- None
- As of
What this law does
Oversight is split between two institutions. A designated member of the National Human Rights Commission (Art. 24.2) is specially responsible for information-protection activity, violations, and implementation of owner rights; the state digital-development and communications body (Art. 25) separately implements the Law, approves security requirements for sensitive, genetic, and biometric information processing, and receives breach notifications.
Art. 26 gives other state bodies continuing oversight within their existing competencies. Art. 28, read in extract, lets a complaint go to the competent authority or the National Human Rights Commission, with a further court appeal available. Art. 30, read in full, defers penalties to the Public Service Law or Labor Law for officials, and to the Criminal Law or the Law on Violations for persons and legal entities, none of which was read. No standalone private right of action distinct from Art. 16.2's damages-and-rights-protection clause was found.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .