MongoliaLaw on Protection of Personal Data, proof of consent, record of processing and assessments
Law on Protection of Personal Data (), Arts. 8.9, 18.2.12, 18.2.13, 23.1-23.2
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- continuous
- Who audits it
- Regulator
- Where the report goes
- Filed with regulator
As of .
What it requires
- Prove that you hold the data subject's consent when you collect personal data, keep a record of your collecting, processing and use of it, and deliver the Article 23 assessment to the National Human Rights Commission before processing by technology that works without human involvement.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state, Decision basis
Logging duty
Article 18.2.12 requires the controller to keep a record of its collecting, processing and use of information; it names no fields, no retention period and no person to whom the record goes. Article 8.9 makes the controller prove it holds the data subject's consent, which cannot be done without a consent record. Article 23.1 to 23.2 requires a documented assessment for processing without human involvement and has it delivered to the National Human Rights Commission, which gives a recommendation on it. Article 18.2.13 (store the information obtained) concerns the data, not a log. Articles 27.8 to 27.10 on audio and video recording systems are not cited here: they let the Commission inspect those systems with law enforcement and let the controller show stored recordings to authorities, and they set no record of the controller's own. No article cited here states a territorial or residence test, so the hook is empty.
- Kind
- Explicit
- As of
- Provision
- Law on Protection of Personal Data, Arts. 18.2.12, 8.9 and 23.2
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
Article 8.9 requires the data controller, when collecting information, to prove that it holds the data subject's consent. Article 18.2.12 requires the controller to keep a record of its collecting, processing and use of information, and Article 18.2.13 requires it to store the information obtained in the course of that activity.
Where a controller collects, processes or uses information with technology that processes it electronically without human involvement, Article 23.1 requires an assessment when the controller makes a decision that affects the data subject's rights, freedoms or legitimate interests or regularly processes sensitive data. Article 23.2 has the controller deliver that assessment to the National Human Rights Commission and proceed on the basis of the Commission's recommendation.
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings or processes biometric data.