MDDI and IMDA consult on proposed Digital Infrastructure Bill to regulate major data centres and cloud service providers

{{socialLink.name}}

{{lL.name }} {{lL.languageCode | uppercase}}

Skip to main navigation

Skip to content

Skip to footer

Office details

Industries and practices

Our people

Careers

{{lL.name }} {{lL.languageCode | uppercase}}

{{lL.name }} {{lL.languageCode | uppercase}}

{{suggestionHead.categoryName}} {{suggestion.name}} {{suggestionHead.categoryName}} {{suggestion.name}}

Home

Insights

On 1 July 2026, the Ministry of Digital Development and Information (MDDI) and the Infocomm Media Development Authority (IMDA) published a consultation paper seeking comments on the draft Digital Infrastructure Bill (Bill). If enacted, the draft Bill would introduce a licensing regime for providers of major foundational digital infrastructure (FDI) services, namely major data centre (DC) facility services and cloud computing services, and a separate licensing regime for DC operators directed at environmental sustainability. The consultation closes on 22 July 2026 at 10:00AM SGT. The Government has stated that it intends to table the draft Bill in Parliament later this year. The proposals remain subject to consultation and Parliamentary passage, and may change before enactment.

The draft Bill is intended to complement the Cybersecurity Act amendments in 2024 by establishing a statutory framework for the broader operational resilience of digital infrastructure, and makes related amendments to the Cybersecurity Act 2018 and Cybersecurity (Amendment) Act 2024 to align the definitions of "foundational digital infrastructure service" and "data centre facility service".

Notably, the draft Bill also contains provisions for extraterritorial application and imposes statutory duties to take measures to ensure security and resilience of major foundational digital infrastructure service (for Major FDI licensees) and to meet environmental sustainability requirements (for DC licensees).

As reported, the draft Bill proposes two licence categories: Major FDI licence and DC licence (as summarised below). An operator of a DC that also provides a major FDI DC facility service (i.e. a CIL of at least 10MW serving unrelated parties) would be required to hold both a major FDI licence and a DC licence. IMDA has indicated that it will streamline the application process for applicants applying for both.

Applicability. Major FDI licensing applies to every provider of a major FDI service, whether the provider is located in Singapore or outside Singapore.

Major FDI service means:

a major DC facility service, i.e. provided in a DC with a critical IT load (CIL) of at least 10MW, which is used to serve parties unrelated to the DC's operator (i.e. cloud and co-location DCs). CIL refers to the maximum electrical power capacity the DC is designed to supply to the IT and network telecommunications equipment housed within it; and

a major regulated cloud computing service, i.e. a CSP that has generated revenue from users in Singapore of at least S$100 million per year on average over the three preceding years, and falls within Infrastructure-as-a-Service (IaaS) or Platform-as-a-Service (PaaS) - but excluding Software-as-a-Service (SaaS).

whether such service is provided from wholly or partially within or outside Singapore, the loss or impairment of the provision of which is likely to lead to or cause disruption or deterioration of the operations of a large number of businesses or organisations in Singapore which rely on or are enabled by that service.

Detailed requirements would be set out in subsidiary legislation and codes of practice, which are expected to draw on the Advisory Guidelines for the Resilience and Security of Cloud Services and Data Centres issued by IMDA on 25 February 2025 (Advisory Guidelines). It is anticipated that practices currently voluntary under the Advisory Guidelines would, in substance, become mandatory for licensees.

Applicability. Operators of DCs with a CIL of at least 3MW would require a DC licence. Under the draft Bill, "operating" a DC means controlling its operations and maintenance, whether the DC serves third parties or is for the operator's own use. Subject to the exemptions below, the DC licensing applies to every operator of a DC located in Singapore, whether the operator is located in Singapore or outside Singapore.

Exemptions. Exemptions from the DC licensing regime: DCs operated by the Government or public authorities (within their own facilities), DCs operated by educational institutions dedicated to R&D, or DCs operated by telecommunications, electricity or gas licensees dedicated to their licensed activities. Notably, these exemptions apply to the DC licensing regime; enterprises operating large DCs purely for their own use would still require a DC licence if the 3MW CIL threshold is met, though they would fall outside the major FDI regime unless serving unrelated parties.

Sustainability Requirements. DC licensees would be required to comply with prescribed facility-level energy efficiency requirements — beginning with power usage effectiveness (PUE) requirements — with the draft Bill also enabling IMDA to prescribe IT equipment-level energy efficiency and facility-level water efficiency requirements in future. IMDA has stated that it will consult DC operators before finalising such requirements, which would be set out in regulations and codes of practice after passage of the draft Bill. The draft Bill also provides that in in making a decision to grant, renew, impose or modify conditions of a DC licence, IMDA must have regard, and give such weight as it considers appropriate to, amongst others, the renewability and carbon intensity of each energy source used to operate the DC as well as the extent that carbon emissions are disposed of, processed or stored, or mitigated by the acquisition and surrender of eligible international carbon credits.

Unlicensed operation. Providing a major FDI service, or operating an in-scope DC, without the requisite licence would constitute an offence punishable by a fine of up to S$100,000, with a further fine of up to S$10,000 per day for a continuing offence.

Breach of statutory duties. A licensee that fails to comply with its security and resilience duties (for major FDI licensees) or environmental sustainability and reporting duties (for DC licensees), or with licence conditions, may be liable to have its licence revoked, suspended, reduced or modified, or be ordered to pay a financial penalty of up to S$1 million or 10% of the licensee's annual turnover in Singapore, whichever is higher.

Extraterritorial application. The draft Bill contains an express extraterritoriality provision. This means that where a person does an act partly in and partly outside Singapore which, if done wholly in Singapore, would constitute an offence against any provision of this Act, that person shall be guilty of that offence as if the act were carried out by that person wholly in Singapore, and may be dealt with as if the offence were committed wholly in Singapore.

Potential officers' liability. The draft Bill extends liability for corporate offences to directors and officers in specified circumstances, such as where an offence is committed with their consent or connivance, or where they knew or ought reasonably to have known that the offence would be or was being committed.

Change of control notification, transfer restrictions. DC licensees would be required to notify IMDA in writing within seven days of becoming aware that any person has become or ceased to be a 5% controller (by equity or voting power, alone or with associates), that any person has become an indirect controller, or that any person has acquired the DC business as a going concern. of both types would be non-transferable without IMDA's prior written approval, with purported transfers void.

Operators and CSPs approaching or exceeding the proposed thresholds may wish to review the draft Bill to assess whether they would fall within scope — noting in particular the IaaS/PaaS scope of the cloud threshold, the CIL basis of the DC thresholds, and the exemptions — and assess current arrangements against the Advisory Guidelines, which are expected to form the basis of the binding requirements. DC operators may additionally wish to assess their facilities' PUE performance and capital expenditure plans, noting that the requirements would extend to existing facilities.

The proposals are also relevant to customers of in-scope providers. A licensee's incident notification obligations to IMDA may not align with its contractual notification obligations to customers, and statutory continuity requirements may affect the risk allocation in existing service level and force majeure provisions.

Organisations wishing to comment on the draft Bill should submit feedback to DigitalInfrastructure@mddi.gov.sg by 22 July 2026, 10:00AM SGT.

REACH/MDDI, Public Consultation on the Digital Infrastructure Bill — full consultation paper (1 July 2026)

Annex A: Draft Digital Infrastructure Bill (PDF)

IMDA, Public Consultation on the Digital Infrastructure Bill (issued 1 July 2026)

IMDA, Advisory Guidelines for the Resilience and Security of Cloud Services and Data Centres (25 February 2025)

MDDI, "New Digital Infrastructure Act to enhance resilience & security of digital infrastructure & services" (1 March 2024)

MDDI, Speech by SMS Tan Kiat How on the Digital Infrastructure Act (February 2026)

S Sivanesan S Sivanesan Senior Partner, SingaporeSingaporeD +65 6885 3685 Email me sivanesan.s@dentons.com

Email me

sivanesan.s@dentons.com

Jean Nie Ho Jean Nie Ho Partner, SingaporeSingaporeD +65 6885 3763 Email me jeannie.ho@dentons.com

Email me

jeannie.ho@dentons.com

Environment and Natural Resources

Environment and Natural Resources

Intellectual Property and Technology

Intellectual Property and Technology

Mergers and Acquisitions

Mergers and Acquisitions

Privacy and Cybersecurity

Privacy and Cybersecurity

LinkedIn

X

Email

Print

© 2026 Dentons Rodyk & Davidson LLP, a limited liability partnership registered in Singapore with Registration No. T07LL0439G. Attorney advertising.

You will now be taken from the Dentons Rodyk website to the $redirectingsite website. To proceed, please click Accept.

Unsolicited emails and other information sent to Dentons will not be considered confidential, may be disclosed to others, may not receive a response, and do not create a lawyer-client relationship. If you are not already a client of Dentons, please do not send us any confidential information.

You are switching to another language. Please click Confirm below to continue.