
Key considerations for the technical requirements in processing sensitive data, including genetic and biometric data
With the enactment of the Personal Data Protection Law ("PDPL") in 2021, Mongolia introduced several advanced and novel legal concepts in the realm of data protection. Notably, the PDPL categorizes personal data based on its nature into various types, including sensitive, confidential, biometric, and genetic information. It also imposes restrictions on the use of such data and requires data controllers to comply with more stringent legal requirements when collecting, using, or processing this type of sensitive data. In conjunction with the PDPL, the Regulation on Processing Sensitive Data was adopted. This Regulation specifies the principles to be adhered to when processing sensitive, biometric, and genetic data. It details the technological security measures and server requirements necessary for the processing of sensitive