Singapore passes Bill tightening data centre security and efficiency rules
About two-thirds of Singapore’s 70 data centres meet the new Bill’s revenue or power-capacity thresholds, while detailed requirements remain under development.
Singapore’s Parliament passed the Digital Infrastructure Bill on Oct 7, introducing licensing requirements covering energy efficiency, security and continuity of operations for major digital infrastructure. Amendments to the Cybersecurity Act will also extend cyber-incident reporting obligations to most major data centres.
The Bill establishes foundational digital infrastructure (FDI) and data centre (DC) licences. An FDI licence will be required for data centres needing at least 10 megawatts (MW) of electrical capacity. Cloud providers will also need one if revenue from Singapore users averages more than S$100 million annually over three years.
FDI licensees must establish physical and cyber security procedures, prepare continuity and disaster recovery plans, and report specified cyber incidents or service interruptions to the Infocomm Media Development Authority (IMDA). Detailed obligations are still being developed for subsidiary regulations and codes of practice.
Facilities using at least 3MW to run essential computing equipment will need a DC licence and must satisfy power usage effectiveness requirements. Those standards have not yet been set. Where cyber-incident reporting obligations overlap, IMDA will serve as the primary contact and share information with the Cyber Security Agency of Singapore.
Senior Minister of State for Digital Development and Information Tan Kiat How said shared reliance on data centres and cloud providers means one disruption can affect multiple services. He acknowledged that older facilities could find compliance harder and said the Government would work with operators needing transition time.
Operators could also face enforcement if they fail to fulfil investment, employment or research commitments made to obtain capacity. These commitments may become licence conditions, with IMDA and the Economic Development Board working together on alleged lapses.
For breaches of cybersecurity and business continuity obligations, the Bill allows IMDA to levy up to S$1 million or 10 per cent of annual Singapore turnover, whichever amount is greater.
