Act 2021
Law of Mongolia on Personal Data Protection (Revised edition)
Issued by National Human Rights Commission of Mongolia
Effective: 1 May 2022
Plain-English summary
Adopted 17 December 2021. It sets consent and other legal bases for processing, data subject rights (Art. 16), breach notification (Art. 22) and supervision by the National Human Rights Commission (Art. 24). Penalties are by reference to the Criminal Code, the Law on Violations and employment law (Art. 30).
Who it applies to
All industries
Topics
Data Protection & Privacy
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Lawful basis, consent and data subject rights | — | National Human Rights Commission of Mongolia | source | |
Arts. 6 and 7 set the grounds on which state bodies and private persons may process personal data. Art. 8 requires written (paper or electronic) consent unless the law provides otherwise, allows withdrawal at any time and puts the burden of proving consent on the controller. Art. 16.1 gives data subjects rights to learn what is held, correct it, obtain a copy, demand erasure of unlawfully collected data and complain. |
||||
| Personal data breach notification | Deadline Immediately (shortest possible duration; no fixed deadline) | National Human Rights Commission of Mongolia | source | |
Art. 22.1 requires a processor to notify the controller of violations immediately, and Art. 22.2-22.3 require the controller to notify the affected data subject immediately where the breach harms their rights, with the likely consequences and remedial steps. Art. 4.1.3 defines 'immediately' as the shortest possible duration, so no fixed hours or days are set. Controllers keep records of breach responses and submit them to the National Human Rights Commission each January or on request (Art. 22.5-22.6). |
||||
| No obligations match these filters. | ||||
Latest news
No related news yet. We publish updates as regulators act.