What new regulatory requirements apply to Singapore's major data centres?
Singapore's Parliament passed new legislation on 7 October 2026, imposing stricter security, resilience, and energy efficiency standards on data centres exceeding S$100 million in annual revenue or 10 megawatts of electrical capacity.
New legislation for critical digital infrastructure
On 7 October 2026, Singapore's Parliament enacted new legislation designed to enhance the security, operational resilience, and energy efficiency of major data centres. The Digital Infrastructure Bill, alongside amendments to the existing Cybersecurity Act, aims to mitigate risks ranging from physical disruptions and operational continuity issues to cyber security threats.
Senior Minister of State for Digital Development and Information, Tan Kiat How, noted during the parliamentary debate that the interconnected nature of digital services means disruptions in a single data centre or cloud provider can create widespread economic and societal impact.
The new framework establishes clear regulatory guidelines, offering businesses certainty while allowing the government flexibility to adjust specific requirements as the digital landscape evolves.
Thresholds for compliance and new licensing
The new regulations target data centres that support critical digital services and meet specific operational thresholds. These include facilities generating an average annual revenue of at least S$100 million from Singaporean users over three years, or those requiring a minimum of 10 megawatts (MW) of electrical capacity for their operations.
Approximately two-thirds of Singapore's 70 data centres are expected to fall under these new requirements. The Digital Infrastructure Bill introduces two types of licences: Foundational Digital Infrastructure (FDI) and Data Centre (DC) licences.
FDI licences are mandated for cloud service providers meeting the S$100 million revenue threshold or data centres consuming 10 MW or more. DC licences will apply to facilities using at least 3 MW of electricity for essential computing equipment.
Operational and energy efficiency standards
FDI licensees will be required to implement processes for physical and cyber security, develop business continuity and disaster recovery strategies, and report prescribed cybersecurity incidents or service disruptions to the Infocomm Media Development Authority (IMDA).
These reporting requirements will align with those already in place for critical information infrastructure operators under the amended Cybersecurity Act, with IMDA serving as the primary reporting channel. For DC licensees, the focus extends to energy efficiency.
These facilities will need to comply with specific Power Usage Effectiveness (PUE) requirements, which measure how efficiently a data centre uses energy. The precise PUE standards are currently being developed and will be detailed in subsidiary regulations and Codes of Practice.
Planning for resource constraints and regional context
The legislative changes also reflect Singapore's strategic approach to managing its limited land, power, and water resources in the face of increasing demand for computing power, particularly for artificial intelligence (AI) applications.
Senior Minister of State Tan Kiat How highlighted that data centre development has become a contentious issue in several countries due to pressures on essential resources. For instance, Thailand froze approvals for new data centre projects in 2026 to develop national standards, while Spain and Australia are drafting similar legislation.
Singapore currently has over 1.6 gigawatts of existing data centre capacity, including 200 MW of new capacity awarded to four operators in August 2026. The government aims to plan proactively to accommodate digital economy growth and AI ambitions within its resource and environmental limits.
Implications for data centre operators
For data centre operators in Singapore, the new Digital Infrastructure Bill and Cybersecurity Act amendments mean increased compliance costs and operational adjustments to meet enhanced security, resilience, and energy efficiency benchmarks.
Operators falling under the FDI or DC licence categories must prepare for new reporting obligations and invest in systems to ensure service continuity and incident recovery. The introduction of PUE requirements for DC licensees will necessitate capital expenditure on more energy-efficient technologies, potentially affecting operational budgets.
While the legislation provides regulatory clarity, it also signals a shift towards more stringent oversight in a resource-constrained environment. Decision-makers in the sector should closely monitor the release of subsidiary regulations and Codes of Practices detailing specific requirements, expected to be finalised in the coming months.
This analysis is journalism, not investment advice; consult a licensed professional before making financial decisions.
Pieces are credited to the desk that commissioned and edited them. Our editorial standards, and the desks behind them, are set out on the Editorial Standards and Team pages.
Further reading
- Briefings · Policy
Will Hong Kong's Five-Year Tax Relief Attract Major Innovation Firms?
Hong Kong lawmakers expressed reservations about the government's plan to offer 5% or 8.25% profits tax for up to five years to innovative companies, arguing the period is too short to draw new headquarters.
Continue reading → - Briefings · Markets
How does Vietnam's 9.95% Q3 growth affect its 2026 target?
Vietnam's economy expanded by 9.95% in the third quarter of 2026, marking its quickest pace in four years, yet it requires a significant acceleration in Q4 to meet its annual goal.
Continue reading → - Briefings · Markets
What does Phu My Hung's 297-unit Triton Crown reveal for Ho Chi Minh City's luxury supply?
Phu My Hung's Triton Crown, a 297-unit luxury residential project launched in late September 2026, occupies one of the last four-frontage sites in Ho Chi Minh City's central Phu My Hung district, targeting affluent buyers.
Continue reading →