12 OCT 2026 — Singapore's parliament approved the Digital Infrastructure Bill on 7 October, putting the country's largest data centres and cloud providers under licence. Data centres will have to meet energy-efficiency standards. The largest facilities, along with major cloud providers, must also meet security and resilience rules and report outages to the regulator. MPs spent part of the debate pressing the government on whether the industry's growth will cost households.
The Infocomm Media Development Authority will administer the new licences. CNA reported that the maximum penalty for most breaches is S$1 million or 10% of a licence holder's annual turnover in Singapore, whichever is higher.
What the law covers
The Ministry of Digital Development and Information says the law sets up two licensing regimes. The first, on security and resilience, applies to co-location and cloud data centres with a critical IT load of at least 10 megawatts. Cloud providers come under it too if their infrastructure and platform services earn an average of S$100 million or more a year from users in Singapore, measured over three years. Those caught by it must manage security risks and plan for keeping services running through a disaster and recovering afterwards. When specified incidents happen, they must tell the regulator.
The second, on sustainability, covers every data centre with a critical IT load of at least 3 megawatts, which CNA described as roughly the power demand of a large suburban mall. As a first step, existing and new facilities must meet energy-efficiency requirements, including power usage effectiveness, the ratio of a site's total power to the power its computers use. Rules on IT equipment and water efficiency could follow. Commitments operators make to win new capacity can also be enforced as licence conditions.
Why Singapore wanted it
The government pointed to an October 2023 outage when it began work on the law. An Equinix data centre failed for four hours, and although there was no cyber attack, the ministry wrote in 2024 that the result was "widespread disruption of banking services". The Cybersecurity Act deals with cyber risks. The new law is meant to cover the rest, such as technical failures, power and cooling problems, and fires.
Singapore hosts more than 1.6 gigawatts of data centre capacity, according to the ministry. The bill went through public consultation in July and was introduced in Parliament on 8 September.
Who pays for the grid
Nineteen MPs spoke during more than five hours of debate over two days. Several asked whether the industry's demand for power would push up household electricity bills. Louis Chua of the Workers' Party asked how much the 60% rise in data centre capacity over the past four years had added to electricity prices. His party colleague He Ting Ru said the cost of any grid upgrades "should not be borne by consumers".
Tan Kiat How, Senior Minister of State for Digital Development and Information, replied that data centres buy power at commercial or wholesale rates, not the regulated household tariff, and pay for their own grid connections. "The household tariff is driven mainly by fuel and electricity generation costs, and the growth of data centres is not expected to raise this cost," he said. Wider grid upgrades benefit everyone, he added, and their costs are shared through the existing grid charging framework.
He dismissed the idea of an "arbitrary cap" on data centre capacity. "Singapore needs more compute as our economy digitalises and AI becomes more widely used, but land, power, water, and our carbon budget are finite," he said. "Our objective cannot simply be more capacity; it must be greater value from the capacity that we host."
When everything fails at once
Other MPs worried about shared weak points. "Banks, clinics, and government services can each comply and still depend on the same cloud provider, substation, cooling station, cooling system, or cable route," said Choo Pei Ling of the governing People's Action Party. She noted that a facility below the 10MW threshold could still serve a critical function. Tan said the law gives the regulator a view across providers. "A single operator sees its own incident. The regulator needs to see the whole system," he said.
What happens next
Several MPs asked for the energy and water efficiency of individual facilities to be published. Tan said agencies would consider what further sector-level information could be released "without disclosing commercially sensitive information". W.Media reported that the detailed requirements will be set out in subsidiary legislation and codes of practice. The ministry has promised existing data centres time to comply.
View author profile → · Editorial policy
