Major data centres, cloud providers could be fined up to $1m under proposed Digital Infrastructure Bill

Large data centres that underpin critical digital services in Singapore will need to account for a range of risks from physical and operational continuity to cybersecurity under a new Bill and amendments to an existing law.

The Digital Infrastructure Bill, passed in Parliament on Oct 7, seeks to ensure energy efficiency and operational resilience – including physical security and recovery from system misconfiguration, fire, flood and power supply cuts – through licensing.

Major data centres will also be subject to cyber-incident reporting requirements under the amended Cybersecurity Act. These requirements will be harmonised with those under the newly passed Bill.

Speaking during the debate on the Bill, supported by all MPs, Senior Minister of State for Digital Development and Information Tan Kiat How said: “Many different digital services often rely on the same data centre or cloud service provider. When it is disrupted, the impact is not confined to one digital service. Many services can be affected at once, and the impact can quickly ripple across our economy and society.”

About two-thirds of the 70 data centres in Singapore cross specific revenue or electrical capacity thresholds under the new Bill. These thresholds are an average annual revenue from users in Singapore over three years of at least $100 million, or operations requiring at least 10 megawatts (MW) of electrical capacity.

The authorities did not name the firms, but those that match this scale include Amazon Web Services, Microsoft Azure and Google Cloud Platform.

Many of these major data centres will also be subject to the amended Cybersecurity Act.

During the five-hour debate on the new Bill spanning Oct 6 and 7, a total of 19 MPs spoke about data centres’ economic value and their impact on Singapore’s competitiveness and jobs, as well as plans for older facilities, sustainability, security and resilience.

MPs such as Sharael Taha (Pasir Ris-Changi GRC) and Saktiandi Supaat (Bishan-Toa Payoh GRC) questioned if the new requirements could weaken Singapore’s competitiveness and drive investments to regional rivals.

Nominated MP Neo Kok Beng and MP Shawn Loh (Jalan Besar GRC) asked if support would be provided to upgrade older data centres, while Lee Hui Ying (Nee Soon GRC) asked how Singaporeans would be upskilled to meet the sector’s growing needs.

Tan said that a sharp rise in demand for computing power to support AI applications has made data centre development a contested and politicised issue globally.

Some countries have had to formulate responses after rapid data centre growth exerted pressure on electricity, water and land. In 2026, Thailand froze approvals for new data centre projects to develop national standards, while Spain and Australia are working on legislation for data centres.

Similarly, Singapore needs to plan ahead with its limited land, power and water.

“We plan ahead... so that we can create as much room as possible for our digital economy and society, as well as AI ambitions, while staying within our resource and environmental constraints,” said Tan.

Singapore has more than 1.6 gigawatts of existing data centre capacity across about 70 data centres. The figure includes 200MW of new capacity awarded to four operators in August.

Tan pointed out that the Bill provides businesses with certainty by setting out the regulatory framework clearly, while also giving the Government the flexibility to calibrate detailed security, resilience and sustainability requirements as circumstances evolve.

The Bill will introduce two licences: the foundational digital infrastructure (FDI) and data centre (DC) licences.

Data centres that require 10MW of electrical power to operate essential computing equipment such as servers, storage drives and networking hardware will need an FDI licence. Cloud service providers that generate more than an average annual revenue of $100 million from Singapore users over three years will also need to apply for an FDI licence.

FDI licensees will have to implement processes to ensure the physical and cybersecurity of their services, put in place business continuity and disaster recovery plans to ensure essential operations can keep going during disruptions, and notify the Infocomm Media Development Authority (IMDA) of prescribed cybersecurity incidents or service disruptions.

Details, which are still being worked out, will be introduced in subsidiary legislation and Codes of Practices.

Where reporting requirements for cybersecurity incidents are similar, IMDA will be the main port of call, and it will share information with the Cyber Security Agency of Singapore.

Operators may be mandated in the future to send users notifications when cyber service disruptions occur, said Tan.

A data centre will need a DC licence if it uses at least 3MW of electricity to power essential computing equipment such as servers, storage drives and networking hardware. DC licensees will need to meet power usage effectiveness (PUE) requirements that are yet to be determined.

PUE measures how efficiently a data centre uses energy, with a perfect score of 1. Data centre contracts awarded to operators in July 2023 had a PUE requirement of 1.3. Proposals selected in August 2026 had a requirement of 1.25.

“PUE is a useful starting point, but it does not capture every dimension of sustainability.

“Efficiency tells us how well a facility uses resources; we must also keep an eye on the sector’s overall use of electricity and water,” said Tan, adding that equipment-level energy efficiency and plant-level water efficiency may be considered in future.

He acknowledged that meeting these requirements will be more challenging for older data centres. Noting that some operators may need transition time, he committed to working with them.

Tan also addressed concerns raised by MPs Edward Chia (Holland-Bukit Timah GRC) and Nadia Samdin (Ang Mo Kio GRC) that households may end up subsidising the electricity costs of data centres.

Assuring the House, he said that the growth of data centres will not raise a household’s electricity costs. This is because data centres do not buy electricity at the regulated household tariff, but at commercial rates or directly from the wholesale electricity market.

Tan also addressed whether data centre operators could face enforcement action for failing to deliver on economic commitments to secure scarce capacity in Singapore. These promises, such as investments, job creation and research, can be made conditions of their licences, he said.

IMDA will work with the Economic Development Board to resolve any alleged lapses.

Tan said that this reflects Singapore’s approach to maximising value from its limited computing capacity. “We are not seeking to attract every megawatt of data centre capacity we can... Scarce capacity should not simply be allocated; it should be put to productive use and deliver the value that was promised,” said Tan.

The Bill empowers IMDA to impose a fine of up to $1 million, or up to 10 per cent of a company’s annual turnover in Singapore, whichever is higher, for failing to meet cybersecurity and business continuity requirements.

Source: The Straits Times © SPH Media Limited. Permission required for reproduction.

Assets of Tokenize Xchange founder and his ex-wife frozen by court order S’pore to contribute marine expertise, international connections to global ocean protection: Gan Kim Yong