Data centre operators seek adequate time to meet green targets under new Bill

Data centre operators have asked for sufficient time to meet new energy-efficiency requirements under proposed new laws to ensure that critical digital infrastructure remains sustainable and resilient.

Providing adequate time for the transition was among several issues raised during a public consultation on the draft Digital Infrastructure Bill from July 1 to 22, which drew feedback from 25 respondents including data centre operators, cloud service providers and industry associations.

Overall, respondents supported the new Bill, which they said was important, given the role of digital infrastructure in supporting Singapore’s digital way of life. They also recognised that data centre capacity increase must be sustainable to conserve Singapore’s scarce natural resources.

The new legislation was tabled in Parliament on Sept 8. If passed, major data centre operators and cloud service providers will have to obtain a licence to operate by mid-2027. They will also need to meet power efficiency, incident reporting and security requirements, which will be finalised from 2027 and updated as technology evolves.

Licensed data centre and cloud service operators could be fined up to $1 million, or up to 10 per cent of their annual turnover in Singapore, whichever is higher, if they fail to meet cybersecurity, business continuity and incident reporting requirements under the proposed new legislation.

The move comes as Singapore is increasingly digitalised, and services offered by data centres and cloud operators power everything from digital banking to ride hailing to e-commerce. At the same time, demand for data centre capacity is growing with the push to adopt artificial intelligence.

In a closing note on the public consultation, the Ministry of Digital Development and Information (MDDI) and Infocomm Media Development Authority (IMDA) said resource-constrained Singapore needs to grow its compute and data centre capacity in a disciplined manner, as such facilities are intensive users of land, power and water.

“Scarce resources must be managed carefully as compute demand grows, so that we make the best use of the resources we have to build the infrastructure Singapore needs, while improving resource efficiency and ensuring that scarce resources generate lasting value,” said MDDI and IMDA.

In a Facebook post on Sept 8, Senior Minister of State for Digital Development and Information Tan Kiat How said that as AI and digital services grow, disruptions from cyberattacks, technical failures or physical incidents can have increasingly serious consequences.

“By planning ahead, we can make sure (digital infrastructure) remains secure and resilient, while enabling Singapore to capture the opportunities of an increasingly digital and AI-powered future,” he said.

The Bill will introduce two licences: foundational digital infrastructure (FDI) and data centre (DC) licences.

Data centres that require 10MW of electrical power to operate essential computing equipment like servers, storage drives and networking hardware will need an FDI licence.

Cloud service providers that generate more than an average annual revenue of $100 million from Singapore users over three years will also need to apply for an FDI licence.

FDI licensees will need to physically and digitally secure their services, have business continuity and disaster recovery plans, and notify IMDA of cybersecurity incidents or service disruptions.

The details, which are still being worked out, will take reference from advisory guidelines introduced in February 2025 for data centre operators and cloud service providers.

Advisory guidelines introduced earlier require data centres to have fire and flood mitigation measures to minimise service disruptions, as well as safeguards against supply chain attacks, malware and ransomware.

Cloud service providers also need to strengthen controls over privileged accounts and user access, and maintain audit logs to detect and investigate security incidents.

A data centre will need a DC licence if it uses at least 3MW of electricity to power essential computing equipment like servers, storage drives and networking hardware.

DC licensees will also need to meet power usage effectiveness (PUE) requirements. PUE measures how efficiently a data centre uses energy. A score that is closer to 1 indicates greater efficiency.

The PUE requirement is yet to be determined. Data centre contracts awarded to operators in July 2023 had a PUE requirement of 1.3. Proposals selected in August 2026 had a requirement of 1.25.

US-based data centre Digital Realty, which took part in the public consultation, had asked for sufficient time to meet new energy requirements.

Serene Nah, managing director and Asia-Pacific head of Digital Realty, said: “A transition period is necessary because it lets us assess sites properly and make upgrades in a structured, non-disruptive way.”

The operator has three data centres in Singapore, two of which have PUE ratings close to 1.3. The third, which begun operating in 2011, has a PUE rating above 1.3.

There are currently about 70 data centres in Singapore. It is estimated that about two-thirds of them will require both the DC and FDI licences.

During the consultation, several respondents called for the Government to streamline the licence application and renewal process, as well as auditing and reporting requirements.

MDDI and IMDA said in response: “We are exploring the streamlining of processes such as a single application form and documentation for all DCs and FDI services covered under (the new law), and will be working with the industry to ensure that these are practical for licensees.”

Respondents said some FDI licensees could be subject to both the Digital Infrastructure Act (DIA) and the Cybersecurity Act, resulting in a duplication of obligations.

The Cybersecurity Act also requires operators of critical information infrastructure to report cybersecurity incidents, including malware infections and denial-of-service attacks.

In response to this, MDDI and IMDA said they and the Cyber Security Agency of Singapore (CSA) will streamline the requirements, compliance and operational processes under the DIA and Cybersecurity Act.

MDDI and IMDA added that where reporting requirements for cybersecurity incidents are similar, licensees need only report to IMDA, with the understanding that relevant information will be shared with the CSA.

Source: The Straits Times © SPH Media Limited. Permission required for reproduction.

Lower collective sale thresholds address upkeep cost of old properties, facilitate renewal: Edwin Tong