Pursuant to Art. 17.1.3 of Mongolia’s Law on Cybersecurity, legal persons providing information technology services for the processing, storage, distribution, computer analytics, and normal operation of shared information systems in cyberspace must retain information-system activity logs for the period specified in the common cybersecurity procedure. Similarly, under Art. 19.2.9, organisations with critical information infrastructure must retain information-system activity logs for the period prescribed by that procedure.
Government Decree No. 06/2023, which establishes the Cyber Security General Procedure, specifies both the required log content and retention periods. Under Section 4.16, covered organisations must retain logs of access attempts and successful access, privileged access, password changes, changes to or deletions of logs, and the granting, modification, or revocation of access rights. Section 4.17 further requires logs to identify, inter alia, the user name or ID, date, accessed address or device information, access duration, action performed, and result of the action. Finally, Section 4.19 sets minimum retention periods, including at least six months for legal persons and at least one year for organisations with critical information infrastructure.

Pursuant to Art. 20.1.5 of the Law on Personal Data Protection, the data controller and data processor are required to conduct a risk assessment to ensure the security of data processing operations.

Mongolian law and jurisprudence lack a fundamental legal framework governing intermediary liability for copyright infringement. Art. 52 of the Law on Copyright merely stipulates that internet service providers, aggregators, website owners, telecommunications service providers, broadcasting organisations, and multi-channel transmitters must facilitate the receipt of reports concerning copyright and related rights infringements. Additionally, they are obligated to suspend or terminate the unlawful use of copyrighted works and related rights on their networks upon receiving such reports.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Mongolia's law and jurisprudence.

Mongolia has adopted the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty. The treaty was signed on 20 December 1996, ratified on 25 July 2002 and came into effect on 25 October 2002.

Under Clause 5.12.9 of Annex I of "Resolution of the Communications Regulatory Commission No. 23 On the Approval of the Terms and Conditions for Obtaining a Special Licence to Provide Telecommunications Services", telephone service providers are required to implement a user registration system that records individual users by their national registration number. In the case of organisational clients, the registration must include the organisation’s registration number as well as the personal registration number, surname, and given name of the authorised individual representing the organisation. Importantly, this requirement applies not only to traditional telephone services but also to Internet Protocol-based telephone services.

Mongolia lacks a comprehensive legal framework for the effective protection of trade secrets. Nevertheless, certain limited provisions address specific aspects of trade secret protection, including those found in the Law of Mongolia on Organisation Secrets. Similar measures are also present in the Law of Mongolia on Competition, which includes regulations concerning unfair competition, such as the misappropriation of trade secrets.

There is no obligation for passive infrastructure sharing in Mongolia to deliver telecom services to end users. However, it is practiced in the mobile sector and in the fixed sector based on commercial agreements.

The leading companies in Mongolia’s telecommunications sector include state-owned and state-dominated entities such as the Information Communication Network Company (NETcom) and Mongolian Telecom (officially, Mongolian Telecommunications Corporation JSC). The government fully owns NETcom, which operates the country’s integrated fibre optic cable network. It also holds a 94.7% stake in Mongolian Telecom, with the remaining 5.3% owned by a mix of foreign and domestic individuals and legal entities.

Mongolia does not mandate functional or accounting separation for operators with significant market power (SMP) in the telecom market.

Pursuant to Art. 8.3 of the "Revised Law on Procurement of Goods, Works, and Services with State and Local Property Funds", foreign entities can be excluded from tendering processes for goods with an estimated cost below MNT 1,000,000,000 (approx. USD 290,000) and for services with an estimated cost below MNT 300,000,000 (approx. USD 86,000). Similarly, Art. 9.2 of the now-repealed "Law on Procurement of Goods, Works, and Services with State and Local Property Funds" contained a comparable provision with a threshold of MNT 100,000,000 (approx. USD 29,000).

Art. 8.4 of the "Revised Law on Procurement of Goods, Works, and Services with State and Local Property Funds" stipulates that preference shall be given to participants offering domestic goods that satisfy any of the specified conditions. Additionally, Art. 8.5 states that priority shall be granted to bidders proposing the use of domestic goods in the execution of the work. Art. 8.6 establishes that, in cases where preferential treatment is applied as outlined in Arts. 8.4 and 8.5, 10% of the price of the domestic goods component shall be deducted from the tender price. If the participant is a small or medium-sized enterprise, this deduction shall be increased to 15%. Similarly, Art. 10 of the now-repealed "Law on Procurement of Goods, Works, and Services with State and Local Property Funds" also provided preferential treatment for local tenderers.

Mongolia is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA); however, it holds observer status since February 1999.

There are no restrictions on foreign ownership in sectors pertinent to digital trade. Under the Law on Investment, foreign investors are granted access to the same investment opportunities as Mongolian citizens and are afforded the same legal protections as domestic investors.

Art. 3.1.5 of the Law on Investment mandates that foreign investors must make a minimum investment of USD 100,000, or its equivalent in tugrik, to establish a business entity. This requirement applies to enterprises in which foreign ownership exceeds 25%. Conversely, Mongolian investors are not subject to any minimum investment threshold.