Singapore tables Digital Infrastructure Bill to license cloud and data centres

The Digital Infrastructure Bill (Bill No. 20/2026) was introduced in the Parliament of Singapore on 8 September 2026 and published for general information in the Republic of Singapore Government Gazette (Bills Supplement No. 20). The Bill, read a first time the same day, establishes a licensing framework for providers of major foundational digital infrastructure services and for operators of data centres in Singapore, and makes related amendments to the Cybersecurity Act 2018.

The regime would be administered by the Info-communications Media Development Authority (IMDA), which may grant, renew, suspend or revoke licences, issue codes of practice and directions, and impose financial penalties. The Bill is organised into nine parts covering administration, licensing of service providers and data centre operators, reconsideration and appeals, enforcement, and saving and transitional provisions.

Two licensing regimes

Part 3 introduces a major FDI licence for providers of major foundational digital infrastructure services, defined as services whose loss or impairment would disrupt the operations of a large number of businesses or organisations in Singapore. Part 4 introduces a DC licence for operators of data centres in Singapore.

• A data centre is a facility carrying a critical IT load of 3 megawatts (MW) or more.
• A major data centre facility service is one delivered in a data centre with a critical IT load of at least 10 MW.
• A major regulated cloud computing service is one that has generated revenue from users in Singapore of at least $100 million per year on average over the preceding three years.
• Regulated cloud computing services cover Infrastructure-as-a-Service and Platform-as-a-Service, but not Software-as-a-Service.

The Schedule specifies data centre facility services and regulated cloud computing services as foundational digital infrastructure services, and their “major” counterparts as major foundational digital infrastructure services.

Security, resilience and environmental duties

Licensees would carry statutory duties. Under Part 3, providers must implement processes to ensure the security (including physical security and cybersecurity) of their services, minimise unexpected interruptions, maintain business continuity and disaster recovery plans, and notify the Authority of cybersecurity incidents or service delivery disruptions. The Minister may also issue emergency certificates to counter serious and imminent threats to national security or the economy, with non-compliance punishable by up to 10 years’ imprisonment.

Under Part 4, data centre operators must meet minimum facility-level energy and water efficiency requirements, ensure information technology equipment complies with equipment-level energy efficiency requirements, and submit annual compliance reports. Licence conditions may require operators to identify and fund low-carbon energy projects, import electricity, or surrender eligible international carbon credits to offset reckonable greenhouse gas emissions.

Enforcement and penalties

Operating without a licence would be an offence carrying a fine of up to $100,000, plus a further $10,000 per day for continuing offences. The Authority may also order financial penalties of up to $1 million or 10% of a licensee’s annual turnover in Singapore, whichever is higher, and may revoke or suspend licences. Data centre operators must report changes of control, including any person becoming a 5% controller, within seven days.

The Bill also provides for reconsideration by the Authority, appeals to the Minister charged with responsibility for regulating digital infrastructure services and data centres, and an Appeals Advisory Panel. Existing providers and operators may continue operating for six months after commencement while their licence applications are pending.

The Bill marks a significant step in regulating Singapore’s cloud and data-centre sector, tying market access to security, resilience and environmental performance as the city-state positions itself as a digital economy hub.

Source: Republic of Singapore Government Gazette, Bills Supplement No. 20, 8 September 2026, p. 1 (official reference: Bill No. 20/2026, Digital Infrastructure Bill).