Availability
Standard DPA provided on request
Trust Centre
Data Processing Agreement
Upstream BPO provides a standard Data Processing Agreement on request, in processor and joint-controller variants. The EU Standard Contractual Clauses are incorporated into the standard DPA, and the UK International Data Transfer Agreement is available for customers subject to UK GDPR.
Key information
At-a-glance governance context
These points summarise the public scope of this page and the main contact or review context around it.
Variants
Processor and joint-controller
EU transfers
Standard Contractual Clauses, 2021 module set
UK transfers
International Data Transfer Agreement (IDTA)
Section 1
Requesting the DPA
Request the standard Data Processing Agreement from dpo@upstreambpo.com. We provide it on request to customers and to prospective customers in active procurement.
This page states what the agreement covers and which transfer mechanisms it carries. The agreement itself holds the legal specificity, and we provide it as a document rather than reproducing its terms here.
Section 2
Two variants
We maintain two variants of the standard agreement, and we confirm which one applies during scoping.
- Processor variant: applies where the customer determines the purposes and means of processing and Upstream BPO processes personal data on the customer's documented instructions. This covers most managed-service engagements.
- Joint-controller variant: applies where Upstream BPO and the customer jointly determine the purposes and means of processing, and the agreement allocates responsibility between the two parties.
Section 3
International transfer mechanisms
The EU Standard Contractual Clauses, 2021 module set, are incorporated into the standard DPA. The applicable module follows from the processing role established in the agreement.
For customers subject to UK GDPR, the UK International Data Transfer Agreement is available. We confirm which instrument applies to an engagement during contracting.
Section 4
Regulations the agreement addresses
The standard DPA is drafted against the data-protection regimes that apply to our operating footprint and to our customers.
- GDPR (EU) 2016/679, together with UK GDPR where the customer is subject to it.
- Malaysian Personal Data Protection Act 2010, which applies to Upstream BPO Sdn. Bhd.
- The Uzbek data-protection regime, where an engagement involves our Uzbekistan operations.
Reviewer questions
Questions we are asked in security review
Answers are stated in full here so they are quotable directly into a security questionnaire.
Do you have a standard DPA?
Yes. Upstream BPO provides a standard Data Processing Agreement on request from dpo@upstreambpo.com, in processor and joint-controller variants.
Do you sign Standard Contractual Clauses?
The EU Standard Contractual Clauses, 2021 module set, are incorporated into our standard DPA. The applicable module follows from the processing role established in the agreement.
We are subject to UK GDPR. What transfer mechanism applies?
The UK International Data Transfer Agreement (IDTA) is available for customers subject to UK GDPR. We confirm which instrument applies during contracting.
Which variant of the DPA applies to us?
The processor variant applies where you determine the purposes and means of processing and Upstream BPO processes personal data on your documented instructions, which covers most managed-service engagements. The joint-controller variant applies where both parties jointly determine purposes and means.
Does the DPA cover subprocessors?
Yes. Subprocessor categories are published on our subprocessors page, the vendor-level list is provided under NDA, and we give 30 days advance notice of any addition or replacement.
Related resources
Related governance and service pages
Use the connected pages below for deeper privacy, governance, service or contact context.
Contact & Escalation
Request the standard Data Processing Agreement from dpo@upstreambpo.com. We acknowledge security and trust enquiries within 3 business days.
Next Step
Need a deeper governance review?
Send certificate requests, subprocessor list requests, incident reports and vulnerability disclosures to dpo@upstreambpo.com. We acknowledge security and trust enquiries within 3 business days.