Singapore has passed a new Digital Infrastructure Bill that will impose licensing, cybersecurity, operational resilience and energy-efficiency requirements on major data centres and cloud service providers, with fines of up to $1 million for non-compliance.
The Bill, passed unanimously in Parliament on October 7, aims to strengthen the resilience of digital infrastructure as demand for computing capacity accelerates, particularly amid the rapid growth of artificial intelligence (AI).
Under the new framework, the Infocomm Media Development Authority (IMDA) can impose a fine of up to $1 million, or 10 per cent of a company’s annual turnover in Singapore, whichever is higher, for failing to meet cybersecurity and business continuity requirements.
Senior Minister of State for Digital Development and Information Tan Kiat How said the concentration of digital services within major data centres and cloud providers means a disruption at one facility could have economy-wide consequences.
“Many different digital services often rely on the same data centre or cloud service provider. When it is disrupted, the impact is not confined to one digital service. Many services can be affected at once, and the impact can quickly ripple across our economy and society,” he said during the parliamentary debate.
Two new licences for data centres and cloud providers
The Bill introduces two licensing regimes: the foundational digital infrastructure (FDI) licence and the data centre (DC) licence.
Data centres using at least 10 megawatts (MW) of electrical capacity for essential computing equipment, including servers, storage and networking hardware, will require an FDI licence.
Cloud service providers with average annual revenue of at least $100 million from Singapore users over three years will also fall under the FDI licensing regime.
About two-thirds of Singapore’s 70 data centres are expected to meet either the revenue or electricity threshold. While the authorities did not name specific companies, providers operating at this scale include Amazon Web Services, Microsoft Azure and Google Cloud Platform.
FDI licensees will be required to maintain physical and cybersecurity measures, business continuity and disaster recovery plans, and report prescribed cybersecurity incidents and service disruptions to IMDA.
A separate DC licence will apply to data centres using at least 3MW of electricity for essential computing equipment. These facilities will also have to meet power usage effectiveness (PUE) requirements, although the specific thresholds have yet to be determined.
AI demand drives tighter data centre regulation
The new regulatory framework comes as Singapore seeks to expand its digital economy while managing constraints on land, electricity and water.
Singapore currently has more than 1.6 gigawatts of data centre capacity across about 70 facilities, including 200MW of new capacity awarded to four operators in August.
Tan said rising demand for computing power to support AI applications has made data centre development an increasingly contested issue globally.
Singapore therefore needs to balance its ambitions to support AI and digital growth with its resource and environmental constraints, he said.
“We plan ahead... so that we can create as much room as possible for our digital economy and society, as well as AI ambitions, while staying within our resource and environmental constraints,” Tan said.
The Bill will also allow the Government to adjust detailed security, resilience and sustainability requirements as circumstances evolve.
Data centres face stricter energy and sustainability rules
Data centre operators will need to meet PUE requirements under the new DC licensing regime. PUE measures how efficiently a data centre uses energy, with a score of 1 representing perfect efficiency.
Singapore’s data centre contracts have already tightened energy-efficiency requirements, with a PUE requirement of 1.3 for facilities awarded in 2023 and 1.25 for proposals selected in August 2026.
Tan said PUE alone does not capture the sector’s overall environmental impact, suggesting that future requirements could also address equipment-level energy efficiency and water efficiency at the plant level.
Older data centres could face greater challenges in meeting the new requirements, with Tan acknowledging that some operators may require transition periods.
Cybersecurity and business continuity under scrutiny
Major data centres will also face cyber-incident reporting requirements under amendments to Singapore’s Cybersecurity Act. The requirements will be aligned with those introduced under the Digital Infrastructure Bill.
IMDA will serve as the main reporting channel where cybersecurity reporting requirements overlap, sharing relevant information with the Cyber Security Agency of Singapore.
The Government may also require operators to notify users when cyber-related service disruptions occur in future.
The Bill comes as policymakers seek to strengthen resilience against disruptions ranging from cyberattacks and system misconfiguration to physical incidents such as fires, floods and power outages.
Singapore seeks value from scarce data centre capacity
The legislation also gives the Government greater leverage over economic commitments made by data centre operators in return for access to scarce capacity.
These commitments can include investments, job creation and research activities, and may be incorporated as licence conditions. IMDA will work with the Economic Development Board to address alleged lapses.
Tan said Singapore was not seeking to attract data centre capacity at any cost. “We are not seeking to attract every megawatt of data centre capacity we can... Scarce capacity should not simply be allocated; it should be put to productive use and deliver the value that was promised,” he said.
During the parliamentary debate, MPs also raised concerns about Singapore’s competitiveness, the upgrading of older facilities and the skills needed to support the sector.
Tan said the new framework would provide greater certainty for businesses while allowing Singapore to calibrate its requirements as technology, security risks and sustainability considerations evolve.