MongoliaLaw on Protection of Personal Data, breach notification
Law on Protection of Personal Data (), Art. 22; Art. 25.1.3; Art. 10.5
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Filed with regulator
What it requires
- An app that is a controller of Mongolian personal data must notify the data subject immediately when a violation found in collecting or processing the data is likely to harm the data subject's rights and legitimate interests, stating the violation, its likely adverse effects and the measures taken. An app that processes data for a controller must tell the controller as soon as it learns of such a violation. A controller must keep a record of the measures taken against the violation and deliver it to the National Human Rights Commission each January and whenever the Commission requires it. An app that suffers a security breach of, or cyberattack on, an information system used to collect, process or use the data must send a notification to the state digital-development and communications body; the Act sets no numeric deadline for that notification.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does "даруй" ("immediately") in Article 22.2 set a time limit that a controller must meet when it tells a data subject of a breach that is likely to harm "мэдээллийн эзний эрх, хууль ёсны ашиг сонирхолд" ("the data subject's rights and legitimate interests"), and what time limit applies to the controller's notice to the state body whose notices Article 25.1.3 describes?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 22.5 requires the controller to keep a record of the measures it took to remove a violation found in collecting or processing data and its adverse effects, and Article 22.6 has that record delivered to the National Human Rights Commission each January and whenever the Commission requires it. The article names no fields for the record, so its contents are left empty, and sets no retention period. The annual delivery is the controller's own filing; the Commission's power to demand the record at any time is the check, so the audit is on request. Article 22.2 and 22.3 (notice to the data subject) and Article 25.1.3 (the ministry body receives and registers the notice of a security breach or cyberattack) are notifications, and the register in 25.1.3 is the authority's own. Article 24.1.4, outside this row, has the Commission review the records it receives.
- Kind
- Explicit
- As of
- Provision
- Article 22.5
- Trigger
- security_incident
What this law does
Art. 25.1.3 has the state digital-development and communications body receive and register notifications submitted by information controllers regarding a security breach of, or cyberattack on, information systems, and take necessary measures immediately, "immediately" itself being a defined term at Art. 4.1.3 meaning the shortest possible period of time, a qualitative rather than numeric standard.
This establishes the regulator's own immediate-action duty on receiving a notification; the Act sets no numeric deadline for a controller's notification to that body. Under Article 22.1 a processor must notify the controller as soon as it learns of a violation found in collecting or processing information.
Under Article 22.2 the controller must notify the data subject immediately where the violation is likely to harm the data subject's rights and legitimate interests, and the notice must set out the violation, its likely adverse effects and the measures taken against them (Article 22.3).
The controller must keep a record of the measures taken against the violation (Article 22.5) and deliver that record to the National Human Rights Commission each January and whenever the Commission requires it (Article 22.6). Art. 10.5 separately provides that meeting the Art. 25.1.2 security requirements is not grounds for exemption from liability arising from information loss.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .