MongoliaLaw on Protection of Personal Data, sensitive personal information
Law on Protection of Personal Data (), Arts. 4.1.12, 9
In force since .
A sensitive categories rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app processing a Mongolian data subject's ethnicity, religion, belief, health, correspondence, genetic or biometric information, criminal-sentence status, sexual orientation, gender identity, or sexual-relations information must satisfy one of the Law's lawful-basis or health or legal-claim grounds before processing; this category expressly includes biometric and genetic information, so an app declaring only a biometric activity is still bound by this instrument, not only by the Law's biometric-data provisions.
These lines are LexLint's reading of the law's text. Also read by: Ministry of Digital Development and Communications of Mongolia (Цахим хөгжил, харилцаа холбооны яам), Minister's Order No. A/90 of approving the technology security requirements and procedure for processing sensitive, genetic and biometric information (guidance, recorded ).
Who enforces it
Settledness
The order is the procedure that Article 25.1.2 directs the ministry to approve, so it binds controllers instead of advising them.
- As of
- Guidance link
- https://legalinfo.mn/mn/detail?lawId=16760452348261
- Guidance body
- Ministry of Digital Development and Communications of Mongolia (Цахим хөгжил, харилцаа холбооны яам), Minister's Order No. A/90 of approving the technology security requirements and procedure for processing sensitive, genetic and biometric information
- Open questions
- Does "энэ хуулийн 6, 7 дугаар зүйлд заасан" ("those set out in Articles 6 and 7 of this Law") in Article 9.2.1 let a private controller process sensitive information on the consent ground that Article 6.1.1 lists, or must a genetic or biometric item also fall within one of the state-body purposes in Article 10.1?
What it makes you log
Logging duty
Article 4.1.12 defines sensitive information and Article 9 bars collecting, processing or using it except on the grounds in Articles 6 and 7 or for health care or legal claims, with the National Human Rights Commission free to give recommendations (Article 9.3). None of it requires a log, register or record.
- Kind
- None
- As of
What this law does
Art. 4.1.12 defines a person's sensitive information to include origin or ethnicity, religion, belief, health, correspondence, genetic and biometric information together, the private key of a digital signature, criminal-sentence status, sexual orientation, gender identity and expression, and sexual-relations information, folding biometric and genetic data directly into the sensitive-information definition rather than treating it as a separate track.
Art. 9 confirms this status carries elevated protection and prohibits collection, processing, or use except under the Act's general lawful-basis articles (Arts. 6-7), a health worker's legal duty, or evidence required by law in response to a legal claim.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .