Singapore is moving to tighten oversight of its data centres and major cloud service providers as the government seeks to strengthen digital resilience while managing the growing demands of artificial intelligence.
Senior Minister of State for Digital Development and Information Tan Kiat How said in Parliament on Oct. 6 that the proposed Digital Infrastructure Bill would provide businesses with greater certainty for long-term investment while ensuring that critical digital infrastructure remains secure, resilient and sustainable.
The Bill introduces two licensing regimes — one focused on the security and resilience of major digital infrastructure services, and another aimed at the environmental sustainability of data centres.
Tan said the move was increasingly important as Singapore’s digital economy expands and more essential services depend on data centres and cloud infrastructure.
“When it is disrupted, the impact is not confined to one digital service,” Tan said. “Many services can be affected at once, and the impact can quickly ripple across our economy and society.”
Digital Economy Reaches S$144.1 Billion
Singapore’s digital economy grew to S$144.1 billion in 2025, accounting for 19.3 per cent of the country’s gross domestic product, according to figures cited by Tan.
The increasing reliance on digital infrastructure means an outage, cyberattack or other disruption affecting a major provider could have consequences well beyond an individual company.
Data centres and cloud services support a wide range of activities, including digital banking, e-commerce, ride-hailing, healthcare, transport and government services.
The government therefore wants major operators to have stronger safeguards covering cybersecurity, physical security, business continuity and disaster recovery.
The legislation also gives the Infocomm Media Development Authority, or IMDA, powers to progressively update baseline requirements as technology, risks and industry practices evolve.
Two Licensing Regimes
The first licensing regime will cover major foundational digital infrastructure services.
This includes major co-location data centres and cloud data centres with a critical IT load of at least 10 megawatts.
Major cloud service providers will also fall under the regime if they generate at least S$100 million in average annual revenue from users in Singapore over the preceding three years and provide qualifying infrastructure or platform cloud services.
Critical IT load refers to the electrical power capacity available to IT and network equipment used to store, process and transport data.
Operators covered by the regime will have to take measures to protect their services against security and operational risks.
They will also be required to maintain business continuity and disaster recovery plans and notify IMDA about cybersecurity incidents or disruptions to service delivery.
Data Centres Face Sustainability Requirements
The second licensing regime focuses specifically on the environmental sustainability of data centres.
Under the Bill, data centres in Singapore with a critical IT load of at least 3MW will require a data centre licence.
The threshold is considerably lower than the 10MW threshold used for the security and resilience regime, meaning a wider range of facilities could be subject to sustainability requirements.
This reflects Singapore’s limited supply of land, electricity and water.
The government has warned that demand for computing capacity is rising rapidly, particularly as companies expand their use of AI.
Tan said Singapore wants to plan ahead and make difficult trade-offs before resource constraints become more severe, allowing the country to continue developing its digital economy while remaining within environmental limits.
AI Is Driving Demand for More Computing Power
The legislation comes as Singapore seeks to expand its role as a regional hub for AI and advanced digital infrastructure.
But the government has made clear that it does not intend to pursue computing capacity at any cost.
Tan previously said Singapore’s ambition was “not maximum compute; it is maximum value from compute”, arguing that Southeast Asian countries can play different roles in the wider AI ecosystem rather than every country attempting to build the same infrastructure.
Singapore already has more than one gigawatt of data-centre capacity, but its limited land, power and water resources place natural constraints on further expansion.
The new regulatory framework is therefore intended to balance growth with sustainability.
Tougher Financial Penalties
The proposed framework also gives authorities stronger enforcement powers.
For most breaches, the maximum financial penalty is S$1 million or 10 per cent of the licensee’s annual turnover in Singapore, whichever is higher.
The Bill provides IMDA with powers to issue directions, impose financial penalties and, in certain circumstances, suspend or revoke licences.
These measures are intended to give the regulator sufficient leverage to ensure that operators meet required standards rather than treating security and resilience measures as voluntary best practices.
Existing Operators Will Have Time to Adapt
The government has also indicated that implementation will take into account the concerns of existing operators.
MDDI and IMDA conducted a public consultation from July 1 to July 22, receiving responses from 25 organisations, including data-centre operators, cloud service providers and industry associations.
Respondents generally supported the objectives of the Bill but sought greater clarity over licensing requirements, implementation timelines and how existing facilities would transition to the new requirements.
Authorities said they intend to streamline licensing and reporting processes and work with the industry on practical implementation.
Existing data centres will also be given time to transition to new energy-efficiency requirements, although the precise transition period has not yet been specified.
Building Confidence for Long-Term Investment
The government argues that stronger regulation should not undermine Singapore’s attractiveness as a data-centre and cloud-services hub.
Instead, Tan said the legislation would provide greater regulatory certainty for companies making long-term infrastructure investments.
The government has been working with major data-centre operators, cloud providers, industry associations and enterprise users in developing the framework.
The Bill is also designed to complement existing cybersecurity legislation. While amendments to the Cybersecurity Act introduced requirements addressing cybersecurity risks for major foundational digital infrastructure services, the new framework would address broader operational resilience, including business continuity and recovery from disruptions.
Singapore Tries to Balance Growth and Constraints
For Singapore, the challenge is increasingly about determining how much digital infrastructure the city-state can accommodate while preserving energy, water and land resources.
AI is expected to increase demand for computing power further, putting pressure on the infrastructure required to run increasingly sophisticated models and digital services.
The Digital Infrastructure Bill represents the government’s attempt to address both sides of that challenge: keep critical infrastructure secure and reliable while ensuring future data-centre growth remains sustainable.
Tan said Singapore’s approach would involve working with industry, progressively raising standards, testing new approaches and carefully allocating scarce data-centre capacity to support national and digital-economy needs.
The Bill was introduced for First Reading in Parliament on Sept. 8. If passed and subsequently brought into force, it will establish the new licensing framework and give IMDA a more direct regulatory role over major digital infrastructure providers and qualifying data centres.
