Clause 4

in subsection (1), replace “section 8” with “sections 7(1A) and 8”;

after subsection (1), insert —“(1A) Section 7(1A) applies to any computer or computer system located wholly outside Singapore that is owned by a person in Singapore.”; and

after subsection (2), insert —“(2A) Subject to subsection (2B) —

Part 3A (except section 16B) applies to any provider of an essential service who is located in Singapore, and is responsible for the cybersecurity of third‑party‑owned critical information infrastructure; and

section 16B applies to any person in Singapore who appears to be a provider of an essential service for which a computer or computer system necessary for the continuous delivery of the essential service is not owned by that person.(2B) Part 3A does not apply to any provider of an essential service in relation to any computer or computer system which is a provider‑owned critical information infrastructure.(2C) Subject to subsection (2D) —

Part 3B (except section 17A) applies to any system of temporary cybersecurity concern located wholly or partly in Singapore; and

section 17A applies to any computer or computer system located wholly or partly in Singapore.(2D) Part 3B does not apply to any computer or computer system which is a provider‑owned critical information infrastructure or a third‑party‑owned critical information infrastructure.(2E) Subject to subsection (2F) —

Part 3C (except section 18A) applies to any entity of special cybersecurity interest incorporated or established under any written law; and

section 18A applies to any entity incorporated or established under any written law whom the Commissioner has reason to believe may fulfil the criteria to be designated as an entity of special cybersecurity interest.(2F) Part 3C does not apply to any entity in relation to any computer or computer system which is a provider‑owned critical information infrastructure or a third‑party‑owned critical information infrastructure.(2G) Subject to subsection (2H) —

Part 3D (except section 18H) applies to any major foundational digital infrastructure service provider that —

provides the foundational digital infrastructure service, whether from within or outside Singapore, to persons in Singapore within the meaning of section 18G; or

provides the foundational digital infrastructure service wholly or partially from Singapore within the meaning of section 18G; and

section 18H applies to any person who appears to be a provider of a foundational digital infrastructure service, whom the Commissioner has reason to believe may fulfil the criteria to be designated as a major foundational digital infrastructure service provider.(2H) Part 3D does not apply to any provider of a foundational digital infrastructure service in relation to any computer or computer system which is a provider‑owned critical information infrastructure or a third‑party‑owned critical information infrastructure.”.