MongoliaLaw on Protection of Personal Data, comprehensive regime
Law on Protection of Personal Data (), in force , Arts. 1-4
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that collects, processes, uses, or secures the personal data of individuals in Mongolia, including via a technical device or software, must fall within the Law's scope and its exemptions before relying on any of them. A purely personal or household use, or using one's own biometric information to secure one's own property, is exempt; most commercial or app-based processing is not.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does Article 3.1, which applies the Law to "хүн, хуулийн этгээд, хуулийн этгээдийн эрхгүй байгууллага" ("a person, a legal entity or an organization without legal-entity status") that collect, process or use personal data, reach a foreign operator with no establishment in Mongolia that collects data from people located in Mongolia?
What it makes you log
Logging duty
Articles 1 to 4 state the Law's purpose, its scope with the exemptions in Article 3.3 (personal and household use, a person's own cameras and own biometric data for their own property, data made public by law), the crime-prevention camera carve-out and the definitions. They impose no log, register or record duty. Article 3.2 applies the Law to processing through technical devices or software and no article cited here states a territorial or residence test, so the hook is empty. Record-keeping provisions sit outside the cited articles and are not coded on this row: Article 8.9 (the controller must prove it holds the data subject's consent), Article 18.2.12 (keep a record of collecting, processing and using data), Article 22.5 and 22.6 (a record of the measures taken against a violation, delivered to the National Human Rights Commission each January and on demand, coded on the breach row), Article 23.2 (an assessment delivered to the Commission) and Articles 27.8 to 27.10 (inspection of and access to recording systems).
- Kind
- None
- As of
What this law does
The Law applies to persons, legal entities, and organizations without legal-entity status that collect, process, use, or secure personal information, including via technical devices and software.
It exempts purely personal or household-family processing that does not infringe the person's own privacy, placing recording devices to protect one's own property or the life or health of oneself or family members, using one's own biometric information for the same purpose, and information legally required to be made public. Arts. 6-8, the Act's general lawful-basis articles, are cross-referenced by Art. 9.2.1 and are not summarised here.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .