Singapore’s Parliament has passed the Digital Infrastructure Bill, creating licensing regimes run by the Infocomm Media Development Authority (IMDA) for large data centres and cloud service providers. The bill follows an October 2023 data centre cooling failure that disrupted banking and payment services for more than 12 hours.
Key points
- Resilience licences will apply to co-location and cloud data centres with a critical IT load of 10MW or more, and to cloud providers whose IaaS or PaaS revenue from Singapore users averages S$100 million or more a year.
- Licensees must manage security and operational risks (including power, cooling, and fire), keep recovery plans, and report specified incidents to IMDA, which can require them to tell users about cyber threats or incidents.
- Penalties can reach S$1 million or 10% of annual Singapore turnover, whichever is higher.
- A separate energy-efficiency licence covers data centres of 3MW or more. Existing operators will have six months to apply once the provisions commence; no date has been announced.
The law mainly affects large data centre and cloud operators serving Singapore. Their customers, especially in financial services, should expect new resilience and incident notification terms in contracts. The approach is similar to the UK Cyber Security and Resilience Bill’s plans for data centres and managed service providers, so multinational providers may be able to align their resilience and incident reporting processes across both.
Source: Ministry of Digital Development and Information
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
