Mongolia. Comprehensive data protection. Law
PDP Law (Mongolia)Law on Personal Data Protection (Law on Protection of Personal Information)
In force
Partly verified
Medium confidence.UN Special Rapporteur (Feb 2026) called for an independent regulator. [Link: official Mongolian (legalinfo.mn); unofficial English translation hosted on legalinfo.mn; authority = NHRC]
§1Summary
- Synopsis
Mongolia's first comprehensive personal data law, covering consent-based processing, security plans and breach notification. Oversight is split between the human rights commission and the digital ministry rather than an independent DPA.
- Key themes
- Unique features
Security rules require processing servers to be located in, and accessible only from, Mongolia.
- SaaS relevance
Foreign SaaS processing Mongolian data may face server-localisation expectations.
§2Obligations
- Breach notification
- Notify state authority and individuals immediately where rights may be harmed
- Cross-border transfers
- Only with legal basis or owner's permission; server localisation
- Maximum penalty
- MNT 20m for entities
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text legalinfo.mn
- English text legalinfo.mn
- Authority
- National Human Rights Commission; Ministry of Digital Development, Innovation and Communications
§5Where it applies
- Domestic law of
- Mongolia
§6Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence.UN Special Rapporteur (Feb 2026) called for an independent regulator. [Link: official Mongolian (legalinfo.mn); unofficial English translation hosted on legalinfo.mn; authority = NHRC]