in forcenot yet in forceblocked by a courtproposedno longer in force
Privacy law9 instruments, 9 in force
Research summary (234 words)
Mongolia's Law on Protection of Personal Data of a Person (, in force ) defines biometric information explicitly: Art. 4.1.1 names fingerprint, iris, face, and voice as illustrative examples, technology-mediated by its own terms, and Art. 4.1.12 folds biometric and genetic information directly into the definition of a person's sensitive information rather than treating it as a separate track.
Art. 14 sets a default prohibition on transferring personal data abroad, lifted only by a statutory basis, an international treaty, or the subject's consent, with no adequacy-assessment mechanism and no public-order, health, or defense fallback grounds, so the cross-border restriction here is strict rather than moderate.
Under Art. 25.1.2 and Minister's Order A/90 of , a server that processes sensitive, genetic or biometric information must be located in Mongolian territory and accessible only from Mongolia.
Art. 25.1.3 requires the digital-development regulator to act immediately (a defined qualitative standard, not a numeric deadline) on receiving a controller's notification of a security breach or cyberattack, and Art. 31 imposes a retroactive duty to destroy fingerprint data collected before the Law took effect unless separately authorized.
Oversight is split between a designated member of the National Human Rights Commission and the state digital-development body, with penalties deferred to the separate Criminal Law and Law on Violations. Chapter 7 (Art. 27) separately regulates the physical placement of audio, video, and audio-video recording devices.
Art. 4.1.1, read in full, defines biometric information as unique bodily data allowing identification of a person with the help of equipment, technical means, or software, and explicitly lists fingerprint pattern, iris, face, voice, and body-movement characteristics as examples, the only jurisdiction in this batch whose statute names a voice or face modality.
Art. 31 (Transitional provisions), read in full, requires destruction of fingerprint data collected by an information controller before the Law entered into force, except as authorized by law, with a government-organized working group to oversee that destruction, a concrete retroactive remediation duty with no parallel found elsewhere in this batch.
Art. 25.1.3 has the state digital-development and communications body receive and register notifications submitted by information controllers regarding a security breach of, or cyberattack on, information systems, and take necessary measures immediately, "immediately" itself being a defined term at Art. 4.1.3 meaning the shortest possible period of time, a qualitative rather than numeric standard.
This establishes the regulator's own immediate-action duty on receiving a notification; the Act sets no numeric deadline for a controller's notification to that body. Under Article 22.1 a processor must notify the controller as soon as it learns of a violation found in collecting or processing information.
Under Article 22.2 the controller must notify the data subject immediately where the violation is likely to harm the data subject's rights and legitimate interests, and the notice must set out the violation, its likely adverse effects and the measures taken against them (Article 22.3).
The controller must keep a record of the measures taken against the violation (Article 22.5) and deliver that record to the National Human Rights Commission each January and whenever the Commission requires it (Article 22.6). Art. 10.5 separately provides that meeting the Art. 25.1.2 security requirements is not grounds for exemption from liability arising from information loss.
The Law applies to persons, legal entities, and organizations without legal-entity status that collect, process, use, or secure personal information, including via technical devices and software.
It exempts purely personal or household-family processing that does not infringe the person's own privacy, placing recording devices to protect one's own property or the life or health of oneself or family members, using one's own biometric information for the same purpose, and information legally required to be made public. Arts. 6-8, the Act's general lawful-basis articles, are cross-referenced by Art. 9.2.1 and are not summarised here.
Article 8.9 requires the data controller, when collecting information, to prove that it holds the data subject's consent. Article 18.2.12 requires the controller to keep a record of its collecting, processing and use of information, and Article 18.2.13 requires it to store the information obtained in the course of that activity.
Where a controller collects, processes or uses information with technology that processes it electronically without human involvement, Article 23.1 requires an assessment when the controller makes a decision that affects the data subject's rights, freedoms or legitimate interests or regularly processes sensitive data. Article 23.2 has the controller deliver that assessment to the National Human Rights Commission and proceed on the basis of the Commission's recommendation.
Art. 14 is a one-paragraph default prohibition: transferring information to a person, legal entity, or international organization in a foreign country is prohibited except as provided by law or an international treaty of Mongolia, or with the information owner's consent. The Act has no adequacy-assessment mechanism, and its own text sets no requirement to store data in Mongolia.
Under Article 25.1.2 the state digital-development and communications body approves the technology security requirements and rules for processing sensitive, genetic and biometric information. Minister's Order A/90 of sets those technology security requirements, including that the server which processes that information must be located in Mongolian territory and accessible only from Mongolia (items 3.2.1 and 3.2.2). The cross-border restriction here is therefore strict rather than moderate.
Article 16 gives a data subject the right to consent to or refuse collection and transfer, know whether their data has been collected or processed, know third-party recipients, correct errors, request deletion, demand enforcement of a legal prohibition on collection, obtain a copy of their own data, transmit that copy to a controller of their own choosing, withdraw from an ongoing processing activity, and complain about, add information to, or demand reprocessing of a decision resulting from data processing.
Art. 16.2 separately gives the subject a right to have unlawful material or moral damage remedied. Art. 15 sets the general deletion grounds: unlawfully collected data, court or treaty-ordered deletion, purpose achieved, or another statutory ground.
Article 18.2.6 requires a controller to explain to the data subject a decision made as a result of processing their information electronically without human involvement, and the consequences that follow from it.
Oversight is split between two institutions. A designated member of the National Human Rights Commission (Art. 24.2) is specially responsible for information-protection activity, violations, and implementation of owner rights; the state digital-development and communications body (Art. 25) separately implements the Law, approves security requirements for sensitive, genetic, and biometric information processing, and receives breach notifications.
Art. 26 gives other state bodies continuing oversight within their existing competencies. Art. 28, read in extract, lets a complaint go to the competent authority or the National Human Rights Commission, with a further court appeal available. Art. 30, read in full, defers penalties to the Public Service Law or Labor Law for officials, and to the Criminal Law or the Law on Violations for persons and legal entities, none of which was read. No standalone private right of action distinct from Art. 16.2's damages-and-rights-protection clause was found.
Art. 4.1.12 defines a person's sensitive information to include origin or ethnicity, religion, belief, health, correspondence, genetic and biometric information together, the private key of a digital signature, criminal-sentence status, sexual orientation, gender identity and expression, and sexual-relations information, folding biometric and genetic data directly into the sensitive-information definition rather than treating it as a separate track.
Art. 9 confirms this status carries elevated protection and prohibits collection, processing, or use except under the Act's general lawful-basis articles (Arts. 6-7), a health worker's legal duty, or evidence required by law in response to a legal claim.
Mongolia's Law on Copyright (Revised edition, promulgated ) is the clearest instrument reaching scraping-adjacent activity: it protects a database as a creative compilation and prohibits reproducing, systematically uploading, or otherwise developing a database's information inconsistent with the rights and legitimate interests of the person who created it, while its general quotation, news, research, and library exceptions create no dedicated text-and-data-mining exception for training on scraped text.
The Law on Cybersecurity (adopted 2021, in force ), read in full, runs to organizations with critical information infrastructure and entities connected to the state information consolidated network rather than to an ordinary web crawler or aggregator, so it does not bind a private scraping operator on the text read.
A computer-misuse-specific criminal provision could not be confirmed here: legalinfo.mn hosts a Criminal Code text headed with a adoption date whose Chapter 25 (Arts. 226-229) criminalizes unauthorized alteration of computer data or programs, unlawful acquisition of computer information, and creating or distributing malicious software, but a later Criminal Code that other Mongolian amendment acts cite as adopted could not be located as its own consolidated text on legalinfo.mn, so which text presently governs computer-misuse offences is not confirmed.
Personal data scraped from a Mongolian source falls under the Law on Protection of Personal Data, already researched under this jurisdiction's privacy topic.
Article 38.1 lists limitations that are not copyright infringement provided the use does not contradict the work's normal exploitation and does not affect the rights and legal interests of the right holder, including quoting and using parts of a work to prepare a news item, quoting for research, training, or criticism, and partial use of works held in archives, museums, and libraries; Article 38.2 conditions every one of those uses on naming the author and source, a non-profit purpose, an extent that meets fair use and the purpose of the use, and no economic impact on the market for the work.
Article 42.1.4 separately lets an archive, museum, or library create an electronic database to facilitate searching and analysis of the works it holds, a narrow library-specific allowance rather than a general exception for text and data mining.
The Copyright Law creates no dedicated text-and-data-mining exception of the kind the EU or Japan carry, so training a model on scraped Mongolian copyrighted text rests only on these general free-use and fair-use grounds where the use can be characterised as research, criticism, news preparation, or library preservation. The Law's text carries no article that fixes the day it came into force, and no day on which it came into force has been located.
Article 4.1.6 defines a database as a creatively created systematic compilation of works and information, other than a computer program, that can be independently accessed in an electronic or other network environment, and Article 6.1.12 lists databases among the categories of protected work.
Article 23.1 provides that the person who created a database, or the copyright holder, loses the right to distribute copies of the database in case of transfer of rights, and Article 24 sets the conditions on which a lawful user of a database may use it: not infringing the copyright of the works it contains, not impeding the database's normal operation, and using only the sections the user is permitted to use.
Article 24.5 separately prohibits reproducing, systematically uploading, or otherwise developing part of a database's information in a way inconsistent with the rights and legitimate interests of the person who created it. This is a compilation-style copyright protection folded into the general Law rather than a stand-alone sui generis database right of the kind the EU or UK carry.
The Law's text carries no article that fixes the day it came into force, and no day on which it came into force has been located.
Mongolia's cyber-resilience law is the Law of Mongolia on Cyber Security (Кибер аюулгүй байдлын тухай), adopted by the State Great Khural of Mongolia on and in force since ; a February 2025 Oxford Global Cyber Security Capacity Centre review and a search found no subsequent repeal or substantive amendment to the Law itself, though Mongolia's Criminal Code and its Laws on Communications, Violations, and Criminal Procedure were amended alongside the Law's original enactment to align cybercrime definitions with the Council of Europe's Budapest Convention, a change already reflected in this jurisdiction's scraping row rather than repeated here.
The Law binds four separate classes of legal person, and only one of the four reaches a declared LexLint activity.
A state-owned legal person (Art. 16, drawing its definition of 'state-owned legal person' from Article 13 of the Law on State and Local Properties) and a legal person providing information technology services in the processing, storing, distributing, computer-analytics, and shared-information-system-hosting sense of Article 17.1, are classifications no activity flag expresses, so they are described here; an organization with critical information infrastructure under Article 19, a Government-adopted list spanning 17 named categories of business from power and water utilities to banks, is filed as rows of its own.
Article 17.1's duties for the class it does reach, an internal procedure, an officer or unit for cyber security, biennial risk assessments, annual information-security audits, a check on new information-technology products and their updates, and immediate notification of both the relevant center and affected users on a cyber-attack, and Article 19's parallel and heavier set for a critical-information-infrastructure operator, annual risk assessments, biennial audits, an action plan, a detection-and-termination system, and notification within one month of receiving a risk-assessment or audit report, are both binding; Article 19's set is filed as rows of its own.
The fourth class, 'legal persons other than that stipulated in article 17.1' (Art. 17.3), is the residual catch-all that reaches every other legal person conducting activity in Mongolia's cyberspace, extended by Article 3.2 to a foreign or foreign-invested legal person operating through Mongolia's information systems and networks; it is the row raised as this jurisdiction's one security-topic instrument, flagged inclusively across this topic's baseline activity set because the duty carries no sector or personal-data gate at all.
The Law sets no security requirement a software product or connected device must meet to be placed on the market and no support-period or update duty running with a product once sold; the nearest text, Article 17.1.8's duty for an information-technology-service legal person to check its own new products and updates, is an operational duty on that narrower class rather than a market-placement regime, and it too sits inside the Article 17.1 deferral.
Enforcement of the Law runs through Article 24, which imposes an official's liability under the Law on Public Service or the Labor Law for non-criminal conduct (Art. 24.1) and a violator's liability under the Criminal Law or the Law on Violations (Art. 24.2, covering both an individual and a legal person) without stating a specific offense or a penalty figure in the Law's own text.
Mongolia's breach-notification duty for personal data sits in the Law on Protection of Personal Data, already this jurisdiction's privacy row; an unauthorized-access or computer-misuse offense sits in the Criminal Code's Chapter 25/26 computer-crime provisions, already this jurisdiction's scraping row, and neither is repeated here.
Mongolia's Law on Cyber Security requires an organization with critical information infrastructure to have an officer or unit on staff in charge of ensuring cyber security. Mongolia's Law on Cyber Security requires an organization with critical information infrastructure to notify the relevant center against cyber-attacks and violations immediately of a failure caused by cyber-attacks.
Article 4.1.12 of the Law on Cyber Security defines an organization with critical information infrastructure as an organization with an information system or information network whose cyber security failure could cause failure of its operations and harm the security, society and economy of Mongolia.
Article 19.1 lists the kinds of business that are organizations with critical information infrastructure, among them banks and financial institutions with consolidated digital systems for payment, settlement and transactions. Article 19.2.4 requires such an organization to have an officer or unit on staff in charge of ensuring cyber security.
Article 19.2.5 requires it to have a cyber security risk assessment conducted every year, and article 19.2.6 requires an information security audit every two years. Article 19.2.10 requires it to submit the risk assessment and audit reports to the relevant center against cyber-attacks and violations within one month of receipt. Article 19.2.8 requires it to have an information system for the detection, registration and termination of cyber-attacks and violations. Article 24.2 makes a violator of the Law liable under the Criminal Law or the Law on Violations.
Article 19.2.14 of the Law on Cyber Security requires an organization with critical information infrastructure to notify the relevant center against cyber-attacks and violations immediately of a failure of the normal, uninterrupted operation of its information systems and infrastructure due to cyber-attacks and violations.
Article 19.2.15 requires it to notify the relevant center and its users immediately of a failure of the normal, uninterrupted operation of its infrastructure due to planned inspections and audits, damage and force majeure events affecting networks and systems outside its own infrastructure. Article 19.2.10 requires it to submit its risk assessment and audit reports to the relevant center within one month of receipt.
Article 17.3 binds every legal person in Mongolia other than one providing information technology processing, storage, distribution, computer-analytics or shared-information-system hosting services under Article 17.1, a narrower duty-bearer this jurisdiction's summary records rather than flags here.
That legal person must abide by the Government's common procedure for ensuring cyber security once adopted, notify the relevant center against cyber-attacks and violations of a cyber-attack or violation against it and obtain assistance where necessary, and comply with the recommendations and requirements the relevant authorities issue.
The Law extends this duty, like the rest of the Law, to a foreign or foreign-invested legal person operating through Mongolia's information systems and networks unless the Law states otherwise. The Public center, which receives this notification for a legal person outside the state information network and critical infrastructure, operates under the state central administrative organization in charge of digital development and communications.
The text sets no numeric clock for this notice, unlike the immediate-notification duty Articles 16.1.3, 17.1.2 and 19.2.14 place on a state-owned legal person, an information-technology-service legal person, and a critical-information-infrastructure operator. A violator faces liability under the Criminal Law or the Law on Violations, on Article 24.2's own cross-reference; the Law's own text names neither statute's specific offense or maximum penalty.
Mongolia's Law on Child Protection (, in force ) requires a citizen or legal entity possessing rights in the internet environment to maintain a special service package for children and, when concluding a service contract, to ask whether children under 18 are in the customer's care and agree whether adult-channel services will be used (art. 8.6).
The same Law separately bars publicizing, through newspapers, television, radio, or a digital network, the identity of a child reported to have committed or been the victim of a crime or violation (art. 8.4), a duty that runs to identifying disclosure rather than to age verification or gating, so it is described here rather than landed as a separate instrument.
The Law on Cybersecurity (adopted 2021, in force ), read in full for this jurisdiction's ai topic, contains no provision addressing a minor's access to a service. The Law on the Rights of the Child (2016), the Law on Broadcasting (2019), and the Law on Combating Cybercrime (2021) are not described here, and the Communications Regulatory Commission's own site (crc.gov.mn) renders only a client-side navigation shell.
A citizen or legal entity possessing rights in the internet environment must maintain a special package of services devoted to children. When concluding a service contract, that citizen or legal entity must ask whether there are children under the age of 18 in the customer's care, and agree with the customer whether to use special channel services for adults.
The duty is part of the Law's original 2016 text; unlike the neighbouring paragraphs of the same article, it carries no later amendment note. Liability for a breach of the Law's child-protection duties is left to a separate Law on Violations, and, for conduct that amounts to a crime, to the Criminal Code; this Law states no fine or penalty figure of its own for art. 8.6.
Mongolia's Law on Copyright (Revised edition, promulgated ) permits quoting and republishing parts of a work for a press review or already-published press and broadcast content on public-interest topics, subject to attribution, a non-profit purpose, a fair-use extent, and no market harm to the original, so snippet and headline reproduction for news reporting has a general free-use ground rather than a dedicated exemption of its own.
The same Law separately names aggregators (defined as a person who collects and delivers content and offers it to the public) among the intermediaries that must not violate copyright on their networks and must act on infringement reports, and lists an unauthorized internet or digital link to a work as its own form of infringement.
No press-publisher neighbouring right, compelled platform-to-publisher bargaining regime, or hot-news misappropriation doctrine distinct from the copyright provisions above appears in the text.
Article 52.1, in Chapter Eight (Protection of copyright and liabilities for copyright violators), requires internet service providers, aggregators, website owners, telecommunications service providers, broadcasting organizations, and multi-channel transmitters not to violate copyright or related rights on their own or another's server, network, or database, and to give right holders the means to enforce their rights there.
The Law itself defines an aggregator as a person who collects and delivers content and offers it to the public. Article 52.2 obligates that same set of actors to act on an infringement report by suspending and closing the illegal use, on pain of liability the state intellectual-property inspector imposes under the Law on Violations.
Separately, Article 56.1.5 lists placing an unauthorized internet or digital link to a work, or developing a work on a social network without the right holder's authorization, among the acts of infringement. Article 57 imposes liability for those infringements under the Criminal Code, the Law on Infringement, or Civil Code damages. The Law's text carries no article that fixes the day it came into force, and no day on which it came into force has been located.
Article 38.1.1 permits quoting and using parts of a work to prepare a news item without the right holder's consent, subject to Article 38.2's conditions of naming the author and source, a non-profit purpose, a fair-use extent, and no economic impact on the market for the work.
Article 39.1 separately defines partial exploitation of a work for news to include preparing a press review from a published work, and publishing, distributing, or transmitting in a newspaper or magazine, for public information purposes, works already published in the press or broadcast through media on current economic, social, legal, political, or religious topics, provided the source has not expressly prohibited reproduction.
The Law's text carries no article that fixes the day it came into force, and no day on which it came into force has been located.
These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.
AI law
Mongolia has no AI-specific transparency, risk, training-data, prohibited-practice, governance, or sector-rule statute confirmed here. The Law on Cybersecurity (adopted 2021, in force ), read in full, addresses cyber-attack response and critical information infrastructure and contains no provision naming artificial intelligence, automated content, or synthetic media.
The National Strategy for Artificial Intelligence and Big Data (2025), developed with UNDP support, is a non-binding government strategy setting out capacity-building and infrastructure goals rather than a legal instrument creating obligations on a private developer or publisher.
Duties attaching to personal data processed by an automated or algorithmic system, including the Law on Protection of Personal Data's rules on automated processing and its data-subject rights, are already researched under this jurisdiction's privacy topic and are not restated here. A deepfake or synthetic-content-specific criminal ban, if one exists in Mongolia's current Criminal Code, is not described here because that code's current consolidated text was not reached.
As of .
Case law
No current case law for Mongolia AI law
No current case law for Mongolia privacy law
No current case law for Mongolia scraping law
No current case law for Mongolia cybersecurity law
No current case law for Mongolia communications law
No current case law for Mongolia content moderation law
No current case law for Mongolia product and AI liability law
No current case law for Mongolia digital accessibility law
No current case law for Mongolia age gating law
No current case law for Mongolia reuse law
Reporting clocks that run here2 instruments
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Mongolia comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
Notify the relevant center against cyber-attacks and violations immediately when the normal, uninterrupted operation of your information systems and infrastructure fails because of cyber-attacks and violations (article 19.2.14).
Notify the relevant center and your users immediately when the normal, uninterrupted operation of your infrastructure fails because of planned inspections and audits, damage, or force majeure events and circumstances affecting networks and systems outside your own infrastructure (article 19.2.15).
Submit each cyber security risk assessment report and information security audit report to the relevant center against cyber-attacks and violations within one month of receiving it (article 19.2.10).
An app that is a controller of Mongolian personal data must notify the data subject immediately when a violation found in collecting or processing the data is likely to harm the data subject's rights and legitimate interests, stating the violation, its likely adverse effects and the measures taken. An app that processes data for a controller must tell the controller as soon as it learns of such a violation.
A controller must keep a record of the measures taken against the violation and deliver it to the National Human Rights Commission each January and whenever the Commission requires it. An app that suffers a security breach of, or cyberattack on, an information system used to collect, process or use the data must send a notification to the state digital-development and communications body; the Act sets no numeric deadline for that notification.
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
