Singapore is moving its largest data centres and cloud platforms from voluntary good practice to a licence that can be suspended, with penalties of up to S$1 million or 10% of Singapore turnover. The Digital Infrastructure Bill (Bill No. 20/2026) was read for the first time on 8 September 2026 and passed by Parliament on 7 October 2026. It creates two licensing regimes administered by the Infocomm Media Development Authority (IMDA): one for security and resilience of "major foundational digital infrastructure" (FDI) services, and one for the energy and water efficiency of data centres. This guide explains who needs which licence, what the security and resilience duties are, how incident reporting will work, how the regime relates to the Cybersecurity Act 2018, and how to prepare during the transition. It is for CISOs, heads of resilience, compliance teams at data centre operators and cloud providers, and the regulated customers who depend on them.
Source note: thresholds, duties, penalties and section numbers are from the Digital Infrastructure Bill (Bill No. 20/2026) as published by the Parliament of Singapore; passage and commencement status are from Baker McKenzie and Rajah & Tann analyses. Confirm against the official text before relying on it.
Key takeaways
- Passed, not yet commenced. Parliament passed the Bill on 7 October 2026; its provisions start on dates the Minister appoints by Gazette notification, and no commencement date had been announced when this guide was checked in November 2026.
- Two thresholds decide the security licence. Data centre facility services in a data centre with at least 10 MW of critical IT load, and IaaS or PaaS cloud services earning on average at least S$100 million a year from Singapore users over the three preceding years, are major FDI services. SaaS is excluded.
- A separate 3 MW licence covers sustainability. Every data centre in Singapore with critical IT load of 3 MW or more needs a data centre licence focused on energy and water efficiency, with audited annual reports.
- Security, continuity and incident reporting become licence duties. Major FDI licensees must keep prescribed physical and cyber security, resilience, business continuity and disaster recovery measures, and notify IMDA of prescribed incidents, with timeframes set in codes of practice.
- Existing operators get six months. Providers already operating can continue for six months after the relevant Part commences, and beyond that while a licence application they filed in time is pending.
Status and timeline
| Date | Event | Source |
|---|---|---|
| 1 to 22 July 2026 | Public consultation on the proposed Bill by the Ministry of Digital Development and Information (MDDI) and IMDA | Rajah & Tann analysis |
| 8 September 2026 | First reading of the Digital Infrastructure Bill, Bill No. 20/2026 | Bill text, Parliament of Singapore |
| 7 October 2026 | Bill passed by Parliament | Baker McKenzie and Rajah & Tann analyses |
| To be appointed | Commencement of each Part by Gazette notification (section 1); six-month licensing transition starts from commencement of Part 3 or Part 4 (section 71) | Bill text |
Until commencement, the obligations below are not yet enforceable. Detailed incident thresholds, reporting timeframes and the security measures themselves will sit in regulations and IMDA codes of practice that had not been published when this guide was checked, so treat any specific timeframe you hear before then as provisional. This guide summarises the Bill as passed and will need updating when commencement notices and codes appear.
Who needs which licence
| Licence | Who is caught | Threshold (Bill Schedule and section 2) | Focus |
|---|---|---|---|
| Major FDI licence (Part 3) | Providers of a major data centre facility service | Data centre facility service in a data centre with critical IT load of at least 10 MW (DCs used solely for the operator's own internal purposes are reported as excluded) | Security, resilience, business continuity, disaster recovery, incident notification |
| Major FDI licence (Part 3) | Providers of a major regulated cloud computing service | IaaS or PaaS with Singapore user revenue of at least S$100 million a year, averaged over the three preceding years; SaaS is not a regulated cloud computing service | As above |
| Data centre licence (Part 4) | Operators of any data centre in Singapore | Critical IT load of 3 MW or more; certain government, public authority, educational research and utility or telecom licensee facilities excluded (section 3(5)) | Energy and water efficiency, permitted IT load, change of control, audited reports |
A large co-location operator can need both licences for the same facility. A hyperscaler can need a major FDI licence for its cloud service and a data centre licence for each Singapore facility above 3 MW. Section 57 gives the Act extraterritorial reach, so a cloud provider serving Singapore users from elsewhere should not assume it is outside scope; confirm with counsel against the final regulations.
Security and resilience duties for major FDI licensees
- Prescribed measures (section 15): maintain security measures covering both physical and cyber security, plus resilience, business continuity and disaster recovery measures as prescribed.
- Incident notification (sections 15 and 16): notify IMDA of prescribed cybersecurity incidents and service disruptions. IMDA codes of practice set the timeframe. Codes have no legislative effect, but section 16(8) requires licensees to comply with them.
- Directions (section 17): IMDA may direct audits, remedial action and notification of affected users about cyber threats.
- Emergencies (section 18): the Minister may certify emergency measures for serious and imminent threats. Failing to comply without reasonable excuse can bring a fine of up to S$50,000, imprisonment of up to 10 years, or both.
- Licence conditions (sections 9 to 13): a Singapore place of business and at least one Singapore-linked officer; transfers need approval; surrender needs six months' notice; renewal applications at least six months before expiry.
What "prescribed measures" will likely need in practice
The measures are still to be prescribed, but MDDI and IMDA have said they will recognise existing standards and certifications where possible. Practical preparation means mapping your current controls to the standards IMDA is most likely to lean on: Singapore's MTCS SS 584 for cloud, ISO/IEC 27001 and ISO 22301 for security and continuity, and facility standards covered in the ANSI/TIA-942 and EN 50600 Guide.
| Control area | What to have ready | NIST SP 800-53 Rev 5 | NIST CSF 2.0 |
|---|---|---|---|
| Business continuity and DR | Tested plans with recovery time objectives per service and evidence of exercises | CP-2 | PR.IR-03, RC.RP-01 |
| Alternate sites and capacity | Failover across availability zones or sites, capacity headroom | CP-7 | PR.IR-04 |
| Power, cooling and fire | Redundant power, generator testing, fire suppression records | PE-11, PE-13 | PR.IR-03 |
| Network carriers | Diverse carriers and routes into each facility | CP-8 | PR.IR-03 |
| Incident notification | Classification matrix, regulator contact rota, timestamped logs | IR-6 | RS.CO-02 |
| Suppliers and sub-processors | Inventory of critical suppliers and their resilience commitments | SA-9 | GV.SC-07 |
| Regulatory tracking | Owner for commencement notices, regulations and codes | PM-28 | GV.OC-03 |
Data centre licence duties
The Part 4 licence is primarily about sustainability rather than security, but it changes how facilities are run and who controls them:
- Permitted load (section 26): the licence specifies the permitted critical IT load.
- Efficiency (sections 25, 35 and 37): facility-level energy efficiency requirements first; equipment-level energy and water efficiency may follow after industry consultation. IMDA may issue efficiency codes.
- Reports (section 36): annual compliance reports, audited and accompanied by the auditor's report.
- Conditions (section 27): may include low-carbon energy projects, emissions mitigation and electricity sourcing. Commitments made to win capacity, for example through a Data Centre Call for Application, can become enforceable conditions.
- Change of control (sections 30 to 33): anyone holding 5% or more of equity or voting power is a "5% controller"; licensees must report changes to IMDA within 7 days of becoming aware.
- Renewal (section 24): apply at least one year before expiry.
Penalties and enforcement
| Breach | Maximum consequence | Section |
|---|---|---|
| Providing a major FDI service without a licence | Fine up to S$100,000, plus up to S$10,000 per day if continuing | 7 |
| Operating a 3 MW+ data centre without a licence | Fine up to S$100,000, plus up to S$10,000 per day if continuing | 23 |
| Failing to answer IMDA information requests on scope | Fine up to S$100,000, plus up to S$5,000 per day | 14, 34 |
| Listed contraventions by a licensee | Financial penalty up to the higher of S$1 million or 10% of annual Singapore turnover | 20, 40 |
| Failing to comply with an IMDA direction | Financial penalty up to S$100,000 | 20(3), 40 |
| Non-compliance with Minister's emergency certificate | Fine up to S$50,000, up to 10 years' imprisonment, or both | 18 |
| Serious licence breaches | Suspension (up to one year) or revocation, after 14 days' notice and a hearing | 19, 39 |
Before a financial penalty, IMDA must give notice with a decision date at least 21 days later. Decisions can be reconsidered by IMDA and appealed to the Minister under Part 5.
How it fits with the Cybersecurity Act 2018
The Cybersecurity (Amendment) Act 2024 created a category of foundational digital infrastructure under the Cybersecurity Act, whose provisions had not commenced when NHI Mgmt Group last checked. Section 70 of the Digital Infrastructure Bill amends the Cybersecurity Act so that its definition of foundational digital infrastructure service points to a Third Schedule, adds definitions for "digital identity management service" and "certificate for authentication", and replaces the definition of "data centre facility service". MDDI and IMDA have said they will streamline the overlap. The practical result is two regulators' instruments touching the same providers: the Cyber Security Agency for cybersecurity under the Cybersecurity Act, and IMDA for licensing, resilience and sustainability under the new Act. See the Singapore Cybersecurity Act Guide.
Where identity fits
Most large cloud and data centre outages and compromises run through privileged access: operator consoles, automation accounts that push configuration across regions, building management systems and remote support channels. When prescribed security measures arrive, expect evidence on who and what can change production at scale. Inventory human and machine administrators, put break-glass and automation credentials under privileged access controls, require phishing-resistant MFA for operator access, and log every change that can affect more than one availability zone. Customers will ask the same questions; see the Cloud Provider Support and Operator Access Controls Guide.
How to prepare: a phased approach
- Scope (now): measure critical IT load per Singapore facility against 3 MW and 10 MW, and compute three-year average Singapore user revenue for each IaaS and PaaS offering against S$100 million. Record the method so IMDA information requests under sections 14 and 34 can be answered quickly.
- Gap assessment (now to commencement): map current certifications (MTCS SS 584, ISO/IEC 27001, ISO 22301, facility tier certifications) to the control areas in the table above and list gaps.
- Incident notification design: build a classification matrix for cybersecurity incidents and service disruptions, a 24x7 regulator notification rota, and templates, then align timeframes when the code of practice is issued.
- Licence governance: name the Singapore-linked officer, set calendar controls for six-month and one-year renewal deadlines, and connect corporate development to the 7-day change-of-control report.
- Apply in the window: file licence applications inside the six months after the relevant Part commences, so operation can continue lawfully while IMDA decides.
- Test: run a joint exercise with major customers covering a multi-zone outage, including regulator and customer notifications. Record results as evidence.
- Review: reassess scope annually, since the cloud revenue test uses a rolling three-year average.
Decision guidance
- Operators near a threshold: treat the higher regime as applicable for planning. Load and revenue grow, and the transition window is short.
- SaaS providers: outside the regulated cloud definition, but customers in regulated sectors will still push resilience requirements down contractually.
- Customers of in-scope providers: the Act does not remove your own obligations, for example under MAS outsourcing and technology risk rules. Use the regime as assurance input, not a substitute. See the MAS Technology Risk Management Guide and the Cloud Concentration Risk and Exit Strategy Guide.
- Small versus large providers: a single-site operator at 4 MW faces sustainability licensing only; a multi-region cloud provider faces both regimes and a heavier evidence burden.
Measurement
- Scope accuracy: facilities and services assessed against thresholds, reviewed annually.
- Recovery performance: percentage of critical services meeting RTO in the latest exercise.
- Notification timeliness: percentage of reportable incidents notified within the code timeframe once published.
- Privileged change coverage: percentage of production-wide changes made through approved, logged privileged paths.
- Licence hygiene: zero missed renewal, surrender or change-of-control deadlines.
Common failure patterns
- Waiting for the codes: the six-month window is too short to build continuity evidence and notification processes from scratch.
- Miscounting critical IT load: using contracted rather than installed or permitted load, or ignoring expansion halls, leads to the wrong licence.
- Ignoring change of control: an investor crossing 5% without a report within 7 days is a licence breach, not a finance matter.
- Single points of failure in automation: one deployment pipeline or credential that can change every region turns a mistake into a nationwide outage.
- Assuming SaaS-on-IaaS customers are covered: customers who rely on the provider's licence without their own exit and continuity plans remain exposed.
Practitioner checklist
- Measure every Singapore facility against 3 MW and 10 MW critical IT load.
- Compute three-year average Singapore user revenue for each IaaS and PaaS service.
- Assign an owner to track commencement notices, regulations and IMDA codes.
- Map existing certifications to continuity, physical, cyber and supplier controls.
- Build a regulator incident notification process and rota before the code arrives.
- Put operator, automation and break-glass access under privileged access controls.
- Set controls for the 7-day change-of-control report and renewal deadlines.
- Diarise the six-month application window from commencement of Parts 3 and 4.
Standards and references
- Parliament of Singapore: Digital Infrastructure Bill No. 20/2026
- Baker McKenzie: Singapore Parliament passes Digital Infrastructure Bill
- Rajah & Tann Asia: Digital Infrastructure Bill passed in Parliament
- NIST: SP 800-53 Rev 5 Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
- ISO: ISO 22301 Business continuity management systems
Related NHI Mgmt Group resources: Singapore Cybersecurity Act Guide · Singapore MTCS SS 584 Guide · Cloud Region Outage Resilience · Business Continuity and Disaster Recovery Guide. This guide summarises the Singapore Digital Infrastructure Bill as passed and is not legal advice.