Law note · Mongolia
Law on Protection of Personal Data, sensitive personal information
What it requires
- An app processing a Mongolian data subject's ethnicity, religion, belief, health, correspondence, genetic or biometric information, criminal-sentence status, sexual orientation, gender identity, or sexual-relations information must satisfy one of the Law's lawful-basis or health or legal-claim grounds before processing; this category expressly includes biometric and genetic information, so an app declaring only a biometric activity is still bound by this instrument, not only by the biometric_privacy instrument.
When LexLint raises it
processes_biometricsprocesses_voicecrawls_webtrains_models
What we found
Art. 4.1.12 defines a person's sensitive information to include origin or ethnicity, religion, belief, health, correspondence, genetic and biometric information together, the private key of a digital signature, criminal-sentence status, sexual orientation, gender identity and expression, and sexual-relations information, folding biometric and genetic data directly into the sensitive-information definition rather than treating it as a separate track.
Art. 9, read in extract, confirms this status carries elevated protection and prohibits collection, processing, or use except under the Act's general lawful-basis articles (Arts. 6-7, not independently read here), a health worker's legal duty, or evidence required by law in response to a legal claim; the extraction was cut off after this third ground.