Law note · Mongolia

Law on Protection of Personal Data, comprehensive regime

cite Law on Protection of Personal Data (17 December 2021), in force 1 May 2022, Arts. 1-4 stage IN FORCE in force since 2022-05-01 kind Comprehensive regime binds public and private bodies reviewed 2026-08-29

What it requires

An app that collects, processes, uses, or secures the personal data of individuals in Mongolia, including via a technical device or software, must fall within the Law's scope and its exemptions before relying on any of them. A purely personal or household use, or using one's own biometric information to secure one's own property, is exempt; most commercial or app-based processing is not.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics

What we found

The Law, read in full for Arts. 1-4, applies to persons, legal entities, and organizations without legal-entity status that collect, process, use, or secure personal information, including via technical devices and software.

It exempts purely personal or household-family processing that does not infringe the person's own privacy, placing recording devices to protect one's own property or the life or health of oneself or family members, using one's own biometric information for the same purpose, and information legally required to be made public.

Arts. 6-8, the Act's general lawful-basis articles, are cross-referenced by Art. 9.2.1 but were not read in this pass, so this document does not assert their specific content.

Primary source

official text, legalinfo.mn, Mongolia's official legal-information portal

← Back to the example · Lint your app →