Singapore Tightens Data Centre, Cloud Rules for Resiliency
Major data centres and cloud providers in Singapore must now meet stricter security and energy efficiency standards under a new bill passed on 7 October 2026.
New Licensing for Critical Infrastructure
Singapore's Parliament passed the Digital Infrastructure Bill on 7 October 2026. This legislation aims to bolster security and energy efficiency for data centres and cloud service providers. The Infocomm Media Development Authority (IMDA) will implement two new licensing frameworks.
The first targets major data centres and cloud providers whose operational failures could impact businesses in Singapore and abroad. Co-location and cloud data centres with a critical IT load of at least 10 megawatts (MW) must now obtain a licence.
Cloud providers generating an average annual revenue of at least S$100 million from Singapore users over three years for their Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS) offerings also fall under this regime. Licensed entities will need to manage security risks, minimise disruptions, maintain recovery plans, and report specific incidents to IMDA.
Addressing Past Outages and Penalties
The new law directly addresses operational risks such as power failures, cooling system malfunctions, and fires, building on existing cybersecurity requirements. This follows a significant incident in October 2023, when a cooling system failure at a Singapore data centre led to over 12 hours of banking and payment service disruptions.
The Ministry of Digital Development and Information (MDDI) reported that this outage resulted in more than 810,000 failed access attempts and 2.5 million failed payment and ATM transactions. IMDA can also mandate operators to inform affected users about specified cybersecurity threats or incidents.
Breaches of certain requirements carry penalties of up to S$1 million or 10 percent of an operator's annual Singapore turnover, whichever is higher.
Energy Efficiency and Capacity Management
A second licensing regime focuses on environmental sustainability. Data centres with a critical IT load of at least 3MW must acquire a licence and adhere to new energy efficiency standards. These regulations apply to both new and existing facilities. The law also allows for future requirements concerning IT equipment and water efficiency.
Operators of existing facilities will have a six-month window from when the relevant provisions take effect to submit their licence applications. Singapore, which currently hosts over 1.6 gigawatts of data centre capacity, seeks to enhance digital resilience while strategically managing its increasing demand for land, power, and water resources.
Data centre and cloud operators in Singapore now face increased compliance costs and operational scrutiny. The new licensing regimes, particularly for facilities exceeding 10MW or cloud services generating S$100 million in local revenue, necessitate significant investment in security, disaster recovery, and energy efficiency upgrades.
For existing facilities, the six-month application window for 3MW+ data centres means a rapid assessment of current infrastructure against new standards. These regulations could drive consolidation in the market or favour larger players with resources for compliance.
Investors in digital infrastructure assets will need to factor in these enhanced operational requirements and potential penalties when evaluating future projects or existing holdings in the city-state.
This article is journalism, not investment advice; consult a licensed professional before making financial decisions. Market data is indicative, may be delayed, and should be verified with your broker or exchange before use.
Comments.
Comments are moderated. We remove what is unlawful, abusive or off-topic, and and you remain responsible for what you post.
Reader comments open soon. Until then, corrections and responses go to our newsroom, and we publish what we get wrong on Corrections.