Our process
- Detect and report. Anyone at Mr.Ooi who suspects an incident reports it to the incident lead immediately.
- Contain. Remove access, rotate credentials, take affected systems offline if needed.
- Assess. What data, whose, how many people, what harm is likely.
- Notify. Clients, regulators and individuals as below.
- Recover and learn. Fix the cause, record a post-incident review and update controls.
Who we tell, and when
| Who | When |
|---|---|
| Affected clients (where client data is involved) | Without undue delay, and within 48 hours of becoming aware |
| India: Data Protection Board of India | Initial intimation without delay and a detailed report within 72 hours, under the DPDP Rules 2025 once in force |
| India: CERT-In | Within 6 hours of noticing a reportable cyber incident, under CERT-In's April 2022 directions |
| India: affected individuals | Without delay, explaining the breach, its likely impact and what they can do |
| Malaysia: Personal Data Protection Commissioner | Within 72 hours where significant harm is likely; affected individuals within 7 days after that |
| Singapore: PDPC | Within 3 calendar days of assessing that a breach is notifiable (likely significant harm, or 500+ individuals); individuals as soon as practicable |
| Australia: OAIC and individuals | As soon as practicable after assessing (within 30 days) that an eligible data breach occurred, if Mr.Ooi is covered by the Privacy Act |
| United States | Under the breach laws of the states where affected residents live |
| EU and UK supervisory authority | Within 72 hours, where the GDPR applies |
Where Mr.Ooi is a processor, the client usually makes the regulator notifications and we give them everything they need in time.
Report a suspected incident: security@mrooi.com.