Singapore seeks feedback on Bill to regulate major data centres, cloud service providers 

[SINGAPORE] The government is seeking feedback from Singaporeans for an upcoming Bill that seeks to improve the security and resilience of digital infrastructure services, and the environmental sustainability of data centre operations in the Republic.

In a statement on Wednesday (Jul 1), the Ministry of Digital Development and Information (MDDI) and the Infocomm Media Development Authority (IMDA) said members of the public have until Jul 22 to submit their views on the draft Digital Infrastructure Bill.

MDDI said in a separate press statement that digital infrastructure services, which include data centres and cloud services, underpin Singapore’s growing digital economy as they enable services such as digital banking and e-commerce to be used by businesses and consumers daily.

“As reliance on these services deepens, the security and resilience of data centres and cloud services have become increasingly important, as service incidents could have a significant impact on the economy and undermine user confidence,” it said.

In recognition of this, Singapore launched an advisory guideline for data centres and cloud services in February last year, to encourage the adoption of best practices to prevent and mitigate the impact of service incidents.

At the same time, MDDI said the government recognises that data centres should be environmentally sustainable and energy efficient, given their resource and environmental footprint. 

Consequently, the authorities launched the Green DC Roadmap in 2024, as well as various standards, to “chart a sustainable pathway” for the data centre sector. 

“We are now taking a step forward, to make a further push for the security and resilience of digital infrastructure services, and sustainability of data centres,” noted MDDI.  

Bill’s features

While a timeline for the tabling of the Bill was not provided, MDDI said it proposes to establish two new licensing regimes.

SEE ALSO

Meta, Microsoft lead US$850 billion boom in data centre leases

Will climate risk derail South-east Asia’s US$564 billion data centre boom?

The first licensing regime deals with the security and resilience of major digital infrastructure services due to the “potential for widespread disruption to businesses and consumers should major digital infrastructure services fail”.  

It said that therefore, major data centres and cloud services provided to users in Singapore must implement security risk management measures, business continuity and disaster recovery plans, and report incidents and disruptions to IMDA.

These requirements, said the ministry, build on the advisory guidelines for the resilience and security of cloud services and data centres.

The licensing regime will apply to large commercial data centre operators with a critical information technology load of at least 10 megawatts (MW) that provide services to other businesses, such as cloud and co-location facilities. 

It will also cover major cloud service providers that generate an average of at least S$100 million a year in revenue from Singapore users of infrastructure-as-a-service or platform-as-a-service offerings. 

The second licensing regime seeks to tackle the environmental sustainability of data centre operations, which involves the licensing of data centre operators running with a critical IT load of at least 3 MW. 

For a start, MDDI said it will require data centres to improve their facility-level energy efficiency.

“We may also consider other efficiency requirements, such as information technology equipment energy efficiency and facility-level water efficiency, in the future,” said the ministry.

It said the authorities aim to ensure that the regulatory framework is “effective in achieving our objectives, yet practical in implementation”.

Aside from referencing relevant overseas regulatory developments, international best practices and standards, it also means “incorporating key learnings from past service incidents in Singapore”.

MDDI said the authorities will also conduct extensive engagements with data centre operators and cloud service providers, as well as their customers.