Mongolia

Arts. 6 and 7 set the grounds on which state bodies and private persons may process personal data. Art. 8 requires written (paper or electronic) consent unless the law provides otherwise, allows withdrawal at any time and puts the burden of proving consent on the controller. Art. 16.1 gives data subjects rights to learn what is held, correct it, obtain a copy, demand erasure of unlawfully collected data and complain.

Art. 22.1 requires a processor to notify the controller of violations immediately, and Art. 22.2-22.3 require the controller to notify the affected data subject immediately where the breach harms their rights, with the likely consequences and remedial steps. Art. 4.1.3 defines 'immediately' as the shortest possible duration, so no fixed hours or days are set. Controllers keep records of breach responses and submit them to the National Human Rights Commission each January or on request (Art. 22.5-22.6).