Law on Protection of Personal Data, breach notification

Law on Protection of Personal Data (17 December 2021), Art. 25.1.3; Art. 10.5

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 May 2022.

A breach notification rule binding public and private bodies.

As of 29 August 2026.

What it requires

An app that suffers a security breach of, or cyberattack on, an information system holding Mongolian personal data must submit a notification to the state digital-development and communications body, which must act on it in the shortest possible time. Whether the Act sets its own numeric deadline for the app's initial notification is not confirmed.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Art. 25.1.3 has the state digital-development and communications body receive and register notifications submitted by information controllers regarding a security breach of, or cyberattack on, information systems, and take necessary measures immediately, "immediately" itself being a defined term at Art. 4.1.3 meaning the shortest possible period of time, a qualitative rather than numeric standard.

This establishes the regulator's own immediate-action duty on receiving a notification; whether the Act imposes its own numeric deadline on a controller's initial notification is not established here (Arts. 18-23). Art. 10.5 separately provides that meeting the Art. 25.1.2 security requirements is not grounds for exemption from liability arising from information loss.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
processes_biometrics
processes_voice

Read the law

official text, legalinfo.mn, Mongolia's official legal-information portal

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app