Mongolia
ModerateLaw on the Protection of Personal Information 2021
Authority: Authority for the Protection of Personal Information | Enforcement: partial | Enacted: May 2022
Overview
Mongolia enacted its Law on the Protection of Personal Information in 2021, effective May 2022. The law establishes a dedicated authority and covers consent, data subject rights, and cross-border transfers. Enforcement capacity is building.
14-Topic Coverage
Data Protection Authority
Fully AddressedAuthority for the Protection of Personal Information oversees compliance.
Consent Requirements
Fully AddressedConsent required. Must be informed, specific, and given freely.
Data Subject Rights
Fully AddressedRights to access, correction, deletion, and restriction.
Cross-Border Transfer
Fully AddressedTransfers require adequate protection or consent.
Breach Notification
Fully AddressedMust notify authority and affected individuals.
DPO Requirements
Partially AddressedRequired for certain organisations.
Children's Data
Partially AddressedGeneral provisions apply. Enhanced protections for children.
Penalties & Enforcement
Fully AddressedAdministrative fines for violations.
Sector-Specific Rules
Partially AddressedBOM financial data rules, health data regulations.
Cookie/Tracking
Not AddressedNo specific cookie regulation.
AI & Automated Decisions
Not AddressedNo specific provisions.
Data Localisation
Partially AddressedSome government data localisation requirements.
Significant Data Fiduciary
Not AddressedNo equivalent concept.
Government Data
Partially AddressedLaw applies to government with exemptions.
Coverage Summary
Quick Navigation
Need Compliance Help?
Our data privacy team can help you navigate Mongolia's regulations.
Book a Consultation