Major data centres, cloud providers could be fined up to $1m under proposed Digital Infrastructure Bill

Major data centre and cloud service operators could be fined up to $1 million, or up to 10 per cent of their annual turnover in Singapore, whichever is higher, for failing to meet cybersecurity, business continuity and incident reporting requirements under proposed new legislation.

The Digital Infrastructure Bill, on which the public can now provide feedback, introduces a licensing regime to hold these data centre and cloud services operators to higher standards of resiliency as they have become the backbone of everyday life.

In a public consultation paper released on July 1, the Ministry of Digital Development and Information (MDDI) and Infocomm Media Development Authority (IMDA) said that such digital infrastructure services offered by data centres and cloud operators power everything from digital banking to ride hailing and e-commerce, and have become essential like traditional mobile and broadband services.

The new legislation was first mooted in March 2024, after a spate of service outages both locally and overseas.

In October 2023, more than 2.5 million payment and ATM transactions could not be completed by two banks due to a fault in the cooling system of a data centre used by the banks. In April 2023, a fire in a Global Switch data centre in Paris brought down Google Cloud services in Europe for weeks for some customers.

MDDI and IMDA said that while the Cybersecurity Act amendments in 2024 established requirements to address cybersecurity risks faced by data centre and cloud operators, there is no statutory framework to ensure broader operational resilience, and the new legislation will cover this gap.

Under the new Bill, a regulatory regime for foundational digital infrastructure (FDI) in Singapore will be introduced.

Foundational digital infrastructure is a data centre with essential computing equipment — servers, storage drives and networking hardware — that requires 10 megawatts (MW) of electrical power to operate. It must also be a service provider to other businesses.

Cloud computing services that generate more than an average annual revenue of $100 million in Singapore users over three years are also foundational digital infrastructure.

These parties have to apply for a major FDI licence, which will require them to ensure the physical and digital security of their services, put in place business continuity and disaster recovery plans, and notify IMDA of cybersecurity incidents or service disruptions.

Detailed requirements for major FDI service providers will be set out in subsidiary legislation and codes of practice. These will take reference from advisory guidelines introduced in February 2025 for data centre operators and cloud service providers.

Advisory guidelines introduced earlier require data centres to put in place fire and flood mitigation measures to minimise service disruptions, and safeguards against supply chain attacks, malware and ransomware, among other requirements. Cloud service providers also need to strengthen controls over privileged accounts and user access, and maintain audit logs to detect and investigate security incidents.

To enhance environmental sustainability, data centre operators that use at least 3MW of electricity will need to apply for a data centre (DC) licence.

These data centre operations will be required to meet power usage effectiveness or PUE requirements, which measure how efficiently a data centre uses energy. A score that is closer to 1 indicates greater efficiency.

Other considerations for DC licence approval include water efficiency, renewability of energy sources, greenhouse gas emissions and contributions to Singapore’s economy.

The Bill also paves the way for energy requirements to be imposed on IT equipment, and water efficiency requirements for the facility in future, amid constraints including limited land, energy and water resources.

Singapore introduced a temporary pause on new data centres in 2019 to review how the sector could grow more sustainably in the resource-constrained nation. At the time, data centres accounted for about 5.3 per cent of the country’s electricity consumption. The figure rose to 7 per cent in 2020 as the Covid-19 pandemic accelerated digitalisation.

The pause was lifted in 2022, with new projects assessed against stricter sustainability requirements. For example, data centres then had to achieve a PUE of 1.3 or lower.

Operators are also expected to tap renewable energy or invest in technologies that reduce or offset carbon emissions. They can also adopt more energy-efficient cooling methods, such as immersion cooling, which uses significantly less energy than conventional air cooling.

The consultation will close on July 22 at 10am.

Source: The Straits Times © SPH Media Limited. Permission required for reproduction.

What makes a good job? Feeling that you matter – Opinion Singapore High Court dismisses Standard Chartered’s appeal to strike out US$2.7 billion 1MDB-linked lawsuit