Since the adoption of the Data Protection Law, the General Intelligence Agency of Mongolia, as ordered by the Prime Minister of Mongolia, has been organizing and supervising the deletion of non-overlapping body data (i.e. fingerprints), which was collected by, compiled by or registered with any person other than the Data Controller. Deletion of fingerprints concerns (i) Data Controllers with fingerprint data stored at and connected to the "KHUR" system of the state information exchange, (ii) public and private legal entities that register the check-in or work hours of employees using fingerprints without permission, and (iii) those who use fingerprints for the purposes of exercising other rights and obligations.

As set forth in the Data Protection Law, the Ministry of Digital Development, Innovation and Communications and the National Human Rights Commission are responsible for the enforcement of the Data Protection Law and will investigate an act or practice if such act or practice may be (i) a violation of the privacy of an individual and (ii) a complaint about the act or practice have been submitted. Pursuant to the Data Protection Law, the Data Owner can submit a claim to the administrative courts or the competent authority as provided under the relevant laws with respect to its complaint on the data collection, processing and use by the state authority. Complaints on data collection, processing and use by the other Data Controllers can be submitted to the other authorised entity or the Human Rights Commission.

Any breach or violations of the Data Protection Law is subject to sanctions under the Violations Law or the Criminal Code of Mongolia. For instance, use of Personal Data against the lawful purposes or the initial permit provided by the Data Owner is subject to a monetary fine in the amount of MNT 500,000 (approx. USD 145) for individuals and MNT 5,000,000 (approx. USD 1,458) for legal entities. Creation of a condition that results in a breach of freedom and legitimate rights of the Data Owner due to a processing of Personal Data in the electronic form without the human interference will also be a subject to monetary fine in the amount of MNT 500,000 (approx. USD 145) for individuals and MNT 5,000,000 (approx. USD 1,458) for legal entities. Illegal collection, processing and transfer of the Personal Data that is not subject to a criminal liability is subject to a monetary fine in the amount of MNT 2,000,000 (approx. USD 583) for individuals and MNT 20,000,000 (approx. USD 5,832) for legal entities.