In accordance with Chapter 2 of the Data Protection Law, state authorities, individuals, legal entities and other natural persons may collect, process and use (i) Personal Data and (ii) Sensitive Personal Data on the grounds provided by law and with the permission of the Data Owner.

The Data Protection Law mainly divides the collection and processing of Personal and Sensitive Personal Data as follows:

• Collection and processing of Personal Data;
• Collection and processing of Sensitive Personal Data;
• Collection and processing of Genetics and Biometric data (types of Sensitive Personal Data); and
• Collection and processing of Personal Data after death of the Data Owner.

State authorities can collect and process Personal Data if:

• permitted to by the Data Owner or permitted by law;
• execution and enforcement of contractual obligations;
• exercising the rights and obligations by the Data Controller during the employment relations;
• enforcement of obligations under the international treaties to which Mongolia is a party to; or
• enforcement actions by authorities as provided under applicable laws without interfering with the legitimate interests and rights of the Data Owner.

Legal entity and any persons other than the state authority can collect and process Personal Data if:

• permitted by the Data Owner or permitted by law;
• execution and enforcement of contractual obligations;
• exercising the rights and obligations by the Data Controller during the employment relations;
• Personal Data became legally available to the public; or
• making historical, scientific, artistic and literary works by maintaining the anonymity of the Data Owner.

Unless otherwise provided under relevant laws, the Data Controller must obtain digital / electronic or written permission from the Data Owner upon presenting the following terms and conditions to the Data Owner:

• Definitive purpose of collecting, processing and using the Personal Data;
• Name and contact information of the Data Controller;
• List of Personal Data to be collected, processed, and used;
• Period of processing and using Personal Data;
• Whether to make the Personal Data publicly available;
• Whether to transfer Personal Data to other persons together with the name of recipient and list of Personal Data to be transferred; and
• Form of cancelling the permission.

The collection, processing and use of Sensitive Personal Data is prohibited except as follows:

• State authorities and other persons as permitted by the Data Owner;
• Health worker to exercise their rights and responsibilities under applicable laws in order to protect the health of an individual; or
• In the process of providing explanations, declarations and evidence in accordance with the law on claims of citizens or legal entities.

Genetic and Biometric data can only be collected and used by the following state authorities in accordance with applicable laws:

• Non-overlapping data of the human body (fingerprints) by the state registration authority for the purposes of civil registration and overseeing the voter registration;
• Biometric data by the border protection authority for the purpose of identifying and verifying a foreign citizen crossing the state border;
• Genetic and biometric information by the competent authorities specified in the law for the purpose of combating, preventing and investigating crimes and violations;
• Genetic and biometric data by court forensic organisation for forensic examination of criminal, civil, administrative and other cases and dispute proceedings;
• Biometric information of the Parliament member for the purposes of attendance and voting; and an employer may, with the employee's permission, use biometric data other than non-identifiable human data (fingerprints) to facilitate the identification and verification of employees in accordance with the internal employment regulations established in accordance with the Labour Law.

Also, Personal Data and Sensitive Personal Data may be collected, processed and used for (i) journalistic purposes or (ii) for the purpose of creating historical, scientific, artistic and literary works and preparing statistical information based on the permission from the Data Owner.

In addition, the Data Protection Law provides that unless otherwise provided by law, (i) if the Data Owner has died or is considered dead, the relevant data shall be collected, processed and used with the written permission of the successor, his / her family member or legal representative and (ii) permission to collect, process or use Sensitive Personal Data is not required 70 years after the death of the Data Owner.