Upcoming Digital Infrastructure Act

15 Oct 2026

1. Further to our client update on the public consultation on the Digital Infrastructure Bill, we update that the Singapore Parliament passed the Digital Infrastructure Bill On 7 October 2026.

2. The Digital Infrastructure Act (“DIA”) seeks to improve the security and resilience of digital infrastructure services and the environmental sustainability of data centre operations in Singapore. The DIA introduces two licensing regimes: the major foundational digital infrastructure (“FDI”) licence and the data centre (“DC”) licence.

3. We set out a brief overview of the two licensing regimes below.
    

Major FDI Licence Scope and Obligations

4. The major FDI licence applies to providers of major foundational digital infrastructure services, including:

• a major data centre facility service delivered in a data centre which carries a critical IT load of at least 10 megawatts; and
• a major regulated cloud computing service, being an Infrastructure-as-a-Service or Platform-as-a-Service that has generated revenue from users in Singapore of at least S$100 million per year on average over the three preceding years.
   

A person must not provide a major foundational digital infrastructure service:

(a)   whether from within or outside Singapore, to users in Singapore; or

(b)   wholly or partially from Singapore, to users in or outside Singapore,

the loss or impairment of the provision of which is likely to lead to or cause disruption or deterioration of the operations of a large number of businesses or organisations in Singapore which rely on or are enabled by the service unless the person has a major FDI licence.

5. Major FDI licensees will be subject to obligations intended to ensure the security and resilience of the licensed service. Major FDI licensees must:

• implement prescribed processes and measures to ensure the physical security and cybersecurity of the service;
• implement prescribed processes and measures to minimise the likelihood of unexpected service interruptions;
• implement prescribed business continuity and disaster recovery plans to ensure the timely resumption of the service; and
• notify the Info-communications Media Development Authority (“IMDA”) of prescribed cybersecurity incidents or service delivery disruptions.

Major FDI licensees will also be required to comply with applicable licence conditions, codes of practice and directions issued by IMDA.
 

DC Licence Scope and Obligations

6. The DC licence applies to a person operating a data centre in Singapore with a critical IT load of 3 megawatts or more. A person is deemed to operate a data centre if the person controls the introduction and implementation of one or more of its operating, maintenance or environmental policies. Where more than one person satisfies this test, the person with the greatest authority to introduce and implement those policies will be regarded as the operator. Certain data centres operated by the Government, public authorities, educational institutions and specified statutory licensees are excluded from the DIA.

7. Holders of a DC licence will be subject to obligations relating to environmental sustainability, reporting and changes in control. DC licensees must:

• comply with prescribed facility-level energy efficiency and water efficiency requirements;
• ensure that information technology equipment installed within the data centre complies with prescribed equipment-level energy efficiency requirements;
• submit regular reports to IMDA regarding compliance with applicable regulations, licence conditions and applicable codes of practice;
• inform IMDA in writing within seven days after becoming aware of specified changes in equity ownership or control; and
• comply with licence conditions relating the commencement of operations, agreed economic or strategic commitments, low-carbon energy projects, greenhouse gas emissions, imported electricity and the use of specified energy sources.

DC licensees will also be required to comply with other applicable licence conditions, codes of practice and directions issued by IMDA.
 

Investigatory and Enforcement Powers

8. The DIA introduces a broad suite of investigatory and enforcement powers.

Investigatory Powers

9. IMDA may require major FDI and DC licensees to provide information and documents necessary to determine the licensee’s compliance with the appliable statutory provisions, licence conditions and applicable codes of practice.

10. On a non-exhaustive basis, authorised officers also have powers to enter and inspect premises, equipment, systems and activities, make recordings, inspect and copy records from electronic material, take necessary equipment and materials onto the premises, and operate electronic equipment in the premises.
     

Enforcement Powers

11. Financial Penalties: For major FDI licensees, IMDA may order financial penalties of up to the higher of S$1 million or 10% of the licensee’s annual turnover in Singapore, for a failure to take measures to ensure the security and resilience of the major FDI service, comply with licence conditions or directions, or any other provisions regulating major FDI licensees.

12. For data centre licensees, IMDA may also order financial penalties of up to the higher of S$1 million or 10% of the licensee’s annual turnover in Singapore for licensees that fail to comply with environmental sustainability obligations, comply with licence conditions or directions, or any other provisions regulating DC licensees.

13. Licence Revocation or Suspension: IMDA may revoke licences, suspend licences, reduce the duration of licences, modify existing licence conditions, impose new licence conditions, or censure a licensee. Additionally, data centre licensees may also be ordered by IMDA to reduce the critical IT load at which the data centre may be operated under the licence. These powers may be exercised where a licensee breaches applicable statutory provisions, licence conditions or written directions from IMDA, among other instances.
     

Key Takeaways

14. The DIA marks a significant development in Singapore’s regulation of digital infrastructure, through introducing a new regulatory framework for major cloud service providers and data centre operators.

15. Businesses providing cloud computing services or data centres services in Singapore should consider the potential impact of the new framework on their compliance, governance, cybersecurity, business continuity and sustainability policies. Businesses contemplating investments involving data centre operators or cloud service providers may also wish to evaluate the implications of the forthcoming requirements.

16. If you have any queries on how the DIA may affect your operations, please do not hesitate to contact us.

17. For more information, please refer to the Digital Infrastructure Bill (accessible here).