Mongolia

Critical information infrastructure organisations must immediately notify the relevant centre against cyber-attacks when an attack stops their systems working normally (Art. 19.2.14). State-owned legal persons (Art. 16.1.3) and IT service providers (Art. 17.1.2) have similar immediate notification duties. Critical infrastructure operators must submit risk assessment and audit reports to the relevant centre within one month of receiving them (Art. 19.2.10).

Arts. 6 and 7 set the grounds on which state bodies and private persons may process personal data. Art. 8 requires written (paper or electronic) consent unless the law provides otherwise, allows withdrawal at any time and puts the burden of proving consent on the controller. Art. 16.1 gives data subjects rights to learn what is held, correct it, obtain a copy, demand erasure of unlawfully collected data and complain.

Art. 22.1 requires a processor to notify the controller of violations immediately, and Art. 22.2-22.3 require the controller to notify the affected data subject immediately where the breach harms their rights, with the likely consequences and remedial steps. Art. 4.1.3 defines 'immediately' as the shortest possible duration, so no fixed hours or days are set. Controllers keep records of breach responses and submit them to the National Human Rights Commission each January or on request (Art. 22.5-22.6).

Art. 14.1 of the Law requires the board or equivalent body to adopt an Internal Monitoring and Risk Management Program, which covers appointing the employees in charge of implementation (Art. 14.4.11), and Art. 14.6 requires periodic monitoring of its effectiveness. The Governor's AML/CFT regulation, Art. 11.4.3, adds procedures for appointing a senior-level compliance officer and defining their powers, and Art. 11.4.7 requires regular reports to the board. The Law text does not use the term 'compliance officer'.

Art. 8.1 requires records to be kept for at least five years after the date of the transaction or the closure of the account. The Governor's regulation, Art. 15.1 and Table 4, sets five years from the end of the relationship or completion of the transaction for KYC, enhanced due diligence and transaction records.

Art. 5.1.1 requires verification before a business relationship is established, Art. 5.3 requires enhanced measures for high-risk customers and Art. 5.11 requires timely updating of ongoing due diligence. The Governor's regulation, Art. 3, sets identification tables for natural persons, legal entities and legal arrangements and requires refusal or termination if identity cannot be verified (Art. 3.7).