The framework
The operative statute in Mongolia is the Law on Personal Data Protection (2021), enforced by the National Human Rights Commission.
For media planning that means an opt-in posture, with consent capture built before campaigns launch.
Key instruments
Law on Personal Data Protection
Mongolia's 2021 law, in force May 2022, replaced a 1990s-era statute with a modern consent-based framework, part of a broader digital-government package.
Marketing and advertising
Consent-based collection and processing with listed exceptions; sensitive data restricted. Treat the consent note above as the planning rule; the penalty line below is what mispricing it costs.
Cross-border transfers
Transfers abroad rely on the individual's consent or an international treaty.
Enforcement and penalties
The authority can impose administrative fines. How often the authority actually enforces sets the real price.