VPNs with servers in Mongolia

The Law on Cyber Security (17 December 2021, in force 1 May 2022) requires a legal entity providing information-technology services through shared information systems to keep the systems’ operation logs for the period set in the general rules on cyber security (art. 17.1.3); the law itself states no period. Whether these duties reach a VPN operator is not established.

The Law on Communications does not itself provide for blocking sites or content. It bars a licence holder from suspending communications service except as legislation provides (art. 25.2.6).

The Law on Cyber Security applies to foreign citizens and to foreign or foreign-invested legal persons operating through Mongolia’s information systems and networks. A person or legal entity breaching it is held liable under the Criminal Code or the Law on Infringement (art. 24.2).

On 25 November 2025 the Constitutional Court ruled article 13.14 of the Criminal Code, on disseminating false information, unconstitutional and suspended it, the CIVICUS Monitor reports.

Article 16(13) of the Constitution protects the privacy of citizens and their families and the confidentiality of correspondence and communication by law. The Constitutional Court (Tsets) has nine members appointed by the State Great Khural for six years and decides disputes about breaches of the Constitution (arts. 64–66).

Under the Law on Cyber Security the Cyber Security Council is chaired by the Prime Minister, with the Government member responsible for digital development and communications and the head of the General Intelligence Agency as deputy chairs (art. 11.2), and the national centre for combating cyber-attacks works within the intelligence agency’s structure. The order of the rows is the security score, and a server’s location is not a recommendation.