Data protection laws in Mongolia
On 17 December 2021, the Parliament of Mongolia (the “Parliament”) adopted the Law of Mongolia on Personal Data Protection (the “Data Protection Law”) which came into effect and full force from 1 May 2022. The Data Protection Law applies to matters related to personal privacy and relations in connection with the collecting, processing, using, and security of Personal Data (as defined below) of an individual, as well as the collection, processing and use of individual’s Personal Data with the help of technology and software. The Data Protection Law regulates the handling of Personal Data and Sensitive Personal Data by Data Controllers (as defined below).
In her report (A/HRC/61/48/Add.1) presented to the UN Human Rights Council in February 2026 following her country visit to Mongolia in April 2025, Ana Brian Nougrères, the UN Special Rapporteur on the right to privacy, described the country’s Data Protection Law as providing “a much-needed comprehensive update” to the legal framework. However, in spite of this, she notes the law as being incomplete, and in need of considerable amendments. Particularly, the Rapporteur noted that the enforcement mechanism is lacking in strength, because the current oversight system (shared between the National Human Rights Commission, the Ministry of Digital Development, Innovation and Communication, and various other state authorities) lacks an independent data protection authority with greater binding power. She states that enforcement remains weak due to limited authority, excessively lenient sanctions, and a low overall level of public awareness. As a result, she recommended the establishment of a dedicated, independent authority in charge of data protection with a higher level of enforceability, audits, and the implementation of proportionate fines, rather than a fixed range.
In September 2025 the Government adopted the National Strategy for Large Data and Artificial Intelligence together with the “Digital First” policy recommendation (Government Resolution No. 108). These policies require that all data processing and AI systems comply fully with the Law on Personal Data Protection and introduce new primary legislation on data and AI ethics, principles which are grounded in human rights, including transparency, accountability, storage limitation, risk-based evaluation and inclusivity. The “Digital First” policy specifically targets low public awareness by mandating nationwide digital literacy programmes, lifelong learning platforms and targeted training for vulnerable groups.
Complementing these initiatives, the Ministry of Digital Development, Innovation and Communications adopted its 2024 - 2028 Strategic Plan in January 2025, which further commits to nationwide awareness-raising on data protection rights, consent mechanisms and ethical AI use, while strengthening cybersecurity and privacy safeguards across e-Mongolia and state systems. These policy documents directly address the enforcement and awareness gaps identified in international reviews and are expected to result in legislative amendments that strengthen data protection requirements and remedies in the coming years.
