Singapore passes licensing law for data centres and cloud providers

Singapore’s Parliament approved the Digital Infrastructure Bill on 7 October 2026, establishing two licensing systems for digital infrastructure. The Infocomm Media Development Authority (IMDA) will oversee the rules, which address service disruptions and energy efficiency.

Under the resilience regime, licences will be required for co-location and cloud data centres whose critical IT load reaches at least 10 megawatts (MW). Cloud providers will also need licences when Singapore-user revenue from Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS) averages at least S$100 million annually over three years.

Licensees must address security risks, limit service interruptions, keep recovery plans and report specified incidents to IMDA. The law covers failures involving power, cooling and fires alongside existing cybersecurity requirements. IMDA may also direct operators to inform affected users about specified cybersecurity threats or incidents.

Certain breaches could attract penalties reaching S$1 million or 10 per cent of annual Singapore turnover, with the higher amount applying.

The energy-efficiency regime applies to both new and existing data centres whose critical IT load is at least 3MW. They must obtain licences and comply with energy standards; additional rules on IT equipment and water efficiency remain possible. Existing operators have six months to apply after the relevant provisions take effect.

An October 2023 data centre cooling failure interrupted banking and payments for more than 12 hours. According to the Ministry of Digital Development and Information, it resulted in over 810,000 unsuccessful access attempts, while failed payment and ATM transactions numbered 2.5 million.