Incident Response

Upstream BPO will notify affected customers within 48 hours of confirming a breach that affects their data. The 48-hour clock starts at confirmation, not at first suspicion, because an unverified alert notified as a breach damages a customer's own regulatory position.

Our notification states what we know at the time of sending: the data affected, the systems involved, the period of exposure where established, and the containment action taken. We follow the first notification with updates as the investigation develops rather than delaying the first notification until the picture is complete.

This commitment sits alongside the breach notification obligations of Malaysia's Personal Data Protection Act 2010, which applies to Upstream BPO Sdn. Bhd. Our 48-hour commitment is contractual to the customer and is not limited to circumstances where a statutory obligation is triggered.

Upstream BPO maintains a documented severity classification. It governs the response path, the escalation route and the communication obligations that attach to each incident, so that the handling of an incident follows its assessed severity rather than the judgement of whoever receives the first alert.

Classification is applied at triage and is revised as an investigation develops. A reclassification upward carries the escalation and communication obligations of the new level from the point of reclassification.

Confirmed incidents receive 24/7 on-call coverage. Coverage is continuous rather than limited to Malaysian business hours, because our delivery operations and our customers span multiple time zones.

The on-call route is used for confirmed incidents. Security enquiries that are not incidents, including questionnaires and control-mapping requests, use the standard trust contact route and receive acknowledgement within 3 business days.

Customers and third parties report suspected or confirmed security incidents to dpo@upstreambpo.com using the subject line “Security Incident Report”. Include the systems or data you believe are affected, the time you observed the issue and any evidence you hold.

Reports of vulnerabilities that have not been exploited use the vulnerability disclosure programme on our security posture page instead, which carries its own acknowledgement and coordinated disclosure timelines.