Mongolia

Art. 4.1.1, read in full, defines biometric information as unique bodily data allowing identification of a person with the help of equipment, technical means, or software, and explicitly lists fingerprint pattern, iris, face, voice, and body-movement characteristics as examples, the only jurisdiction in this batch whose statute names a voice or face modality.

Art. 31 (Transitional provisions), read in full, requires destruction of fingerprint data collected by an information controller before the Law entered into force, except as authorized by law, with a government-organized working group to oversee that destruction, a concrete retroactive remediation duty with no parallel found elsewhere in this batch.

Art. 25.1.3 has the state digital-development and communications body receive and register notifications submitted by information controllers regarding a security breach of, or cyberattack on, information systems, and take necessary measures immediately, "immediately" itself being a defined term at Art. 4.1.3 meaning the shortest possible period of time, a qualitative rather than numeric standard.

This establishes the regulator's own immediate-action duty on receiving a notification; whether the Act imposes its own numeric deadline on a controller's initial notification is not established here (Arts. 18-23). Art. 10.5 separately provides that meeting the Art. 25.1.2 security requirements is not grounds for exemption from liability arising from information loss.

The Law applies to persons, legal entities, and organizations without legal-entity status that collect, process, use, or secure personal information, including via technical devices and software.

It exempts purely personal or household-family processing that does not infringe the person's own privacy, placing recording devices to protect one's own property or the life or health of oneself or family members, using one's own biometric information for the same purpose, and information legally required to be made public. Arts. 6-8, the Act's general lawful-basis articles, are cross-referenced by Art. 9.2.1 and are not summarised here.

Art. 14, read in full, is a one-paragraph default prohibition: transferring information to a person, legal entity, or international organization in a foreign country is prohibited except as provided by law or an international treaty of Mongolia, or with the information owner's consent.

There is no adequacy-assessment mechanism and no localization or domestic-storage requirement of the kind Kazakhstan, Uzbekistan, Tajikistan, and Turkmenistan all carry; nothing in the Act requires a Mongolian database to exist at all. This is a structurally different, narrower-gateway approach than the rest of the batch, which is why the cross-border restriction here is strict rather than moderate.

Art. 16, read in full, is the richest rights list in this batch: consent to or refuse collection and transfer, know whether one's data has been collected or processed, know third-party recipients, correct errors, request deletion, demand enforcement of a legal prohibition on collection, obtain a copy of one's own data, transmit that copy to a controller of one's own choosing (a genuine data-portability right), withdraw from an ongoing processing activity, and object to and demand reprocessing of a decision resulting from data processing.

Art. 16.2 separately gives the subject a right to have unlawful material or moral damage remedied. Art. 15 sets the general deletion grounds: unlawfully collected data, court or treaty-ordered deletion, purpose achieved, or another statutory ground.

Oversight is split between two institutions. A designated member of the National Human Rights Commission (Art. 24.2) is specially responsible for information-protection activity, violations, and implementation of owner rights; the state digital-development and communications body (Art. 25) separately implements the Law, approves security requirements for sensitive, genetic, and biometric information processing, and receives breach notifications.

Art. 26 gives other state bodies continuing oversight within their existing competencies. Art. 28, read in extract, lets a complaint go to the competent authority or the National Human Rights Commission, with a further court appeal available. Art. 30, read in full, defers penalties to the Public Service Law or Labor Law for officials, and to the Criminal Law or the Law on Violations for persons and legal entities, none of which was read. No standalone private right of action distinct from Art. 16.2's damages-and-rights-protection clause was found.

Art. 4.1.12 defines a person's sensitive information to include origin or ethnicity, religion, belief, health, correspondence, genetic and biometric information together, the private key of a digital signature, criminal-sentence status, sexual orientation, gender identity and expression, and sexual-relations information, folding biometric and genetic data directly into the sensitive-information definition rather than treating it as a separate track.

Art. 9 confirms this status carries elevated protection and prohibits collection, processing, or use except under the Act's general lawful-basis articles (Arts. 6-7), a health worker's legal duty, or evidence required by law in response to a legal claim.

Article 38.1 lists limitations that are not copyright infringement provided the use does not contradict the work's normal exploitation and does not affect the rights and legal interests of the right holder, including quoting and using parts of a work to prepare a news item, quoting for research, training, or criticism, and partial use of works held in archives, museums, and libraries; Article 38.2 conditions every one of those uses on naming the author and source, a non-profit purpose, an extent that meets fair use and the purpose of the use, and no economic impact on the market for the work.

Article 42.1.4 separately lets an archive, museum, or library create an electronic database to facilitate searching and analysis of the works it holds, a narrow library-specific allowance rather than a general exception for text and data mining.

The Copyright Law creates no dedicated text-and-data-mining exception of the kind the EU or Japan carry, so training a model on scraped Mongolian copyrighted text rests only on these general free-use and fair-use grounds where the use can be characterised as research, criticism, news preparation, or library preservation.

Article 4.1.6 defines a database as a creatively created systematic compilation of works and information, other than a computer program, that can be independently accessed in an electronic or other network environment, and Article 6.1.12 lists databases among the categories of protected work.

Article 23.1 gives the database's creator or rights holder the exclusive right to distribute copies of the database, and Article 24 sets the conditions on which a lawful user of a database may use it: not infringing the copyright of the works it contains, not impeding the database's normal operation, and using only the sections the user is permitted to use.

Article 24.5 separately prohibits reproducing, systematically uploading, or otherwise developing part of a database's information in a way inconsistent with the rights and legitimate interests of the person who created it. This is a compilation-style copyright protection folded into the general Law rather than a stand-alone sui generis database right of the kind the EU or UK carry.

Article 17.3 binds every legal person in Mongolia other than one providing information technology processing, storage, distribution, computer-analytics or shared-information-system hosting services under Article 17.1, a narrower duty-bearer this jurisdiction's summary records rather than flags here.

That legal person must abide by the Government's common procedure for ensuring cyber security once adopted, notify the relevant center against cyber-attacks and violations of a cyber-attack or violation against it and obtain assistance where necessary, and comply with the recommendations and requirements the relevant authorities issue.

The Law extends this duty, like the rest of the Law, to a foreign or foreign-invested legal person operating through Mongolia's information systems and networks unless the Law states otherwise. The Public center, which receives this notification for a legal person outside the state information network and critical infrastructure, operates under the state central administrative organization in charge of digital development and communications.

The text sets no numeric clock for this notice, unlike the immediate-notification duty Articles 16.1.3, 17.1.2 and 19.2.14 place on a state-owned legal person, an information-technology-service legal person, and a critical-information-infrastructure operator. A violator faces liability under the Criminal Law or the Law on Violations, on Article 24.2's own cross-reference; the Law's own text names neither statute's specific offense or maximum penalty.

A citizen or legal entity possessing rights in the internet environment must maintain a special package of services devoted to children. When concluding a service contract, that citizen or legal entity must ask whether there are children under the age of 18 in the customer's care, and agree with the customer whether to use special channel services for adults.

The duty is part of the Law's original 2016 text; unlike the neighbouring paragraphs of the same article, it carries no later amendment note. Liability for a breach of the Law's child-protection duties is left to a separate Law on Violations, and, for conduct that amounts to a crime, to the Criminal Code; this Law states no fine or penalty figure of its own for art. 8.6.

Article 52.1, in Chapter Eight (Protection of copyright and liabilities for copyright violators), requires internet service providers, aggregators, website owners, telecommunications service providers, broadcasting organizations, and multi-channel transmitters not to violate copyright or related rights on their own or another's server, network, or database, and to give right holders the means to enforce their rights there.

The Law itself defines an aggregator as a person who collects and delivers content and offers it to the public. Article 52.2 obligates that same set of actors to act on an infringement report by suspending and closing the illegal use, on pain of liability the state intellectual-property inspector imposes under the Law on Violations.

Separately, Article 56.1.5 lists placing an unauthorized internet or digital link to a work, or developing a work on a social network without the right holder's authorization, among the acts of infringement. Article 57 imposes liability for those infringements under the Criminal Code, the Law on Infringement, or Civil Code damages.

Article 38.1.1 permits quoting and using parts of a work to prepare a news item without the right holder's consent, subject to Article 38.2's conditions of naming the author and source, a non-profit purpose, a fair-use extent, and no economic impact on the market for the work.

Article 39.1 separately defines partial exploitation of a work for news to include preparing a press review from a published work, and publishing, distributing, or transmitting in a newspaper or magazine, for public information purposes, works already published in the press or broadcast through media on current economic, social, legal, political, or religious topics, provided the source has not expressly prohibited reproduction.