There is no obligation for passive infrastructure sharing in Mongolia to deliver telecom services to end users. However, it is practiced in the mobile sector and in the fixed sector based on commercial agreements.

The leading companies in Mongolia’s telecommunications sector include state-owned and state-dominated entities such as the Information Communication Network Company (NETcom) and Mongolian Telecom (officially, Mongolian Telecommunications Corporation JSC). The government fully owns NETcom, which operates the country’s integrated fibre optic cable network. It also holds a 94.7% stake in Mongolian Telecom, with the remaining 5.3% owned by a mix of foreign and domestic individuals and legal entities.

Mongolia does not mandate functional or accounting separation for operators with significant market power (SMP) in the telecom market.

Mongolia has appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

It is reported that the Communications Regulatory Commission, the executive authority for the supervision and administration of services in the telecommunications sector, is independent from the government in the decision-making process.

It is reported that specific financial data subject to data localisation requirements cannot be transmitted internationally.

Section 3 of the "Regulation on Technical Requirements for Processing Sensitive, Biometric, and Genetic Data" sets out the requirements for servers processing sensitive personal information. Among other stipulations, it mandates that the server be physically located within Mongolia and accessible exclusively from within Mongolia.
Pursuant to Section 1, the objective of this Regulation is to establish the principles and technological security requirements governing the processing of sensitive personal data, as well as genetic and biometric data, as stipulated in Arts. 9 and 10 of the Law on the Protection of Personal Data.

Art. 14.1 of the Law on Personal Data Protection prohibits the transfer of personal data to an individual, legal entity, or international organisation in a foreign country, except as permitted by law and international treaties of Mongolia or with the explicit consent of the data subject.

Mongolia has not joined any agreement with binding commitments to open transfers of data across borders. Art. 9.12.5 of the Agreement between Japan and Mongolia for an Economic Partnership, which entered into force in 2016, merely acknowledges the importance of maintaining cross-border information flows as a fundamental component of a dynamic electronic commerce environment. In addition, Art. 9.10 stipulates that neither party shall require: (a) a service supplier of the other party; (b) an investor of the other party; or (c) an investment of an investor of the other party within the territory of the former party, as a condition for conducting its business in that territory, to use or establish computing facilities in that area. This provision does not preclude either party from adopting or maintaining measures regulating the use or location of computing facilities where necessary to achieve a legitimate public policy objective, provided that such measures are not applied in a manner that constitutes arbitrary or unjustifiable discrimination or a disguised restriction on trade.

The Law of Mongolia on Personal Data Protection provides a comprehensive regime of data protection in Mongolia. It governs matters pertaining to personal privacy and regulates the collection, processing, use, and security of individuals’ personal data. The Law designates the National Human Rights Commission of Mongolia and the Ministry of Digital Development and Communications as the supervisory authorities responsible for overseeing compliance.
Other relevant legislation includes the Law of Mongolia on Cyber Security, the Law of Mongolia on Electronic Signature, and the Law of Mongolia on Public Information Transparency, all of which came into effect concurrently with the Law on Personal Data Protection. In addition to these overarching regulations, Mongolia’s data protection framework is supplemented by sector-specific legislation in the healthcare and financial sectors.

Pursuant to Art. 17.1.3 of Mongolia’s Law on Cybersecurity, legal persons providing information technology services for the processing, storage, distribution, computer analytics, and normal operation of shared information systems in cyberspace must retain information-system activity logs for the period specified in the common cybersecurity procedure. Similarly, under Art. 19.2.9, organisations with critical information infrastructure must retain information-system activity logs for the period prescribed by that procedure.
Government Decree No. 06/2023, which establishes the Cyber Security General Procedure, specifies both the required log content and retention periods. Under Section 4.16, covered organisations must retain logs of access attempts and successful access, privileged access, password changes, changes to or deletions of logs, and the granting, modification, or revocation of access rights. Section 4.17 further requires logs to identify, inter alia, the user name or ID, date, accessed address or device information, access duration, action performed, and result of the action. Finally, Section 4.19 sets minimum retention periods, including at least six months for legal persons and at least one year for organisations with critical information infrastructure.

Pursuant to Art. 20.1.5 of the Law on Personal Data Protection, the data controller and data processor are required to conduct a risk assessment to ensure the security of data processing operations.

Reports indicate that the widespread use of pirated software is prevalent among Mongolian government ministries, individual consumers, and businesses.

Mongolia has adopted the World Intellectual Property Organization (WIPO) Copyright Treaty. The treaty was signed on 20 December 1996, ratified on 25 July 2002 and came into effect on 25 October 2002.