Singapore’s Proposed Digital Infrastructure Bill Explained

The requirement would apply whether the provider is based in Singapore or overseas, provided it supplies the relevant major FDI service to users in Singapore . The available descriptions identify IaaS and PaaS, rather than SaaS, as the cloud categories covered by the revenue threshold .

DC Operator licence

A separate DC Operator licence would apply to data centres in Singapore with a critical IT load of at least 3 MW . This tier is primarily designed to establish and enforce baseline environmental and resource-efficiency requirements across the data-centre sector, rather than applying only to the largest providers .

A data centre could therefore fall under the DC licensing regime without meeting the 10 MW threshold for major FDI classification. Qualifying large data centres may face both the wider DC requirements and the additional security and resilience obligations attached to major FDI services.

What would major FDI licensees have to do?

The proposed framework would require major FDI providers to manage both cyber and non-cyber risks. The main areas are:

• Cybersecurity: take measures to protect covered data-centre facilities and cloud services, complementing Singapore’s existing Cybersecurity Act framework .
• Physical security: protect facilities and infrastructure against unauthorised access and other physical threats .
• Business continuity: maintain arrangements intended to keep services operating during disruption .
• Disaster recovery: prepare and maintain plans for restoring services after an outage or other incident .
• Incident reporting: report relevant cybersecurity incidents and service-delivery disruptions to IMDA, improving regulatory visibility into events affecting major infrastructure .
• Regulatory compliance: follow licence conditions and applicable IMDA directions .

The proposal is broader than a cyber-only regime. It treats service continuity as a combination of digital security, physical protection, operational planning and recovery capability .

Proposed penalties

For a licensee that breaches the proposed obligations, licence conditions or an IMDA direction, the maximum financial penalty would be the higher of:

• S$1 million; or
• 10% of the licensee’s annual turnover in Singapore .

That structure would make the potential exposure scale with the operator’s Singapore business, rather than imposing only a fixed maximum. The draft also proposes separate offences for providing a service without a required licence; the exact application of those provisions should be read against the Bill’s text and any final legislation .

Sustainability rules for data centres

The DC Operator regime would create a legal basis for mandatory sustainability standards covering data centres of at least 3 MW. The proposal points to several areas of assessment and reporting:

• Energy efficiency, including Power Usage Effectiveness (PUE) requirements .
• Water efficiency, including Water Usage Effectiveness (WUE) benchmarks .
• Energy sources, including consideration of renewable-energy use and the extent of greenhouse-gas emissions .
• Operational and capacity data, such as information that could help regulators assess utilisation and other economic or operational contributions .

The consultation materials do not establish all of the final numerical thresholds. In particular, the precise PUE and WUE values, renewable-energy percentages and emissions caps were expected to be developed through subsidiary legislation, standards or codes of practice rather than fixed in the high-level proposal .

That distinction matters for operators: the Bill would establish the licensing and enforcement framework, but some of the practical compliance targets would come later.

Potential future controls on equipment and water use

The proposed framework also leaves room for additional requirements to be introduced later. These could include:

• efficiency standards for IT equipment such as servers and storage systems; and
• further facility-level water-efficiency requirements, potentially covering cooling systems and related infrastructure .

The available consultation reporting describes these as potential future standards, not as fully specified obligations already containing final technical thresholds .

Why Singapore proposed the Bill

The policy rationale combines infrastructure dependence with Singapore’s physical resource constraints. MDDI and IMDA describe data-centre facilities and cloud-computing services as essential to the wider digital economy, making disruption risks more consequential and increasing the case for stronger resilience requirements .

The proposal also responds to pressure on energy, water and land as demand for data-centre capacity grows, including demand associated with AI workloads . In this context, sustainability is not presented as a separate voluntary initiative: the DC licence would give IMDA a mechanism to impose and enforce baseline environmental standards .

Reports and consultation materials also refer to service disruptions and outages as part of the background to stronger oversight. However, the sources provided do not establish a single exhaustive list of incidents or support every sector-specific impact sometimes attributed to them. The safer conclusion is that the Bill responds to a broader concern about the resilience of concentrated digital infrastructure, alongside intensifying resource constraints .

Consultation timeline

MDDI and IMDA launched the public consultation on 1 July 2026. The deadline for feedback was 10:00 AM on 22 July 2026, Singapore time, with submissions invited through the REACH consultation process or by email to IMDA .

The proposal should therefore be read as a consultation-stage framework, not as a final statement of every technical requirement. The clearest immediate implications are the two licensing thresholds, the new resilience and reporting expectations for major FDI providers, and the move toward enforceable sustainability standards for data centres of at least 3 MW.