TRW & Co · Digital infrastructure
Digital Infrastructure Act: Licensing for Data Centres and Cloud Providers
The Digital Infrastructure Act in Singapore, passed as the Digital Infrastructure Bill on 7 October 2026, will require IMDA licences for major data centres and cloud providers. Facilities of 10 MW or more and cloud providers with large Singapore revenue face security and resilience duties; every data centre of 3 MW or more faces energy-efficiency rules. Commencement is yet to be announced.
Key pointCommitments made to win new data centre capacity can become enforceable licence conditions, so a capacity bid is now a compliance document as well as a commercial one.
At a glance
Passed 7 October 2026
The Digital Infrastructure Bill had First Reading on 8 September 2026 and passed on 7 October 2026; IMDA will administer it once commenced.
Major FDI licence
Required for co-location and cloud data centres of at least 10 MW critical IT load and cloud providers with S$100 million average Singapore revenue.
Data centre licence
All data centre operators with a critical IT load of at least 3 MW need a licence focused initially on facility-level energy efficiency.
Resilience beyond cyber
Duties cover technical failures, power or cooling problems and fires as well as cyber incidents, with reporting of specified disruptions to IMDA.
Significant penalties
IMDA may impose penalties of up to the higher of S$1 million or 10% of annual Singapore turnover for contraventions, and can revoke licences.
Swipe or scroll →
The Digital Infrastructure Act in Singapore: the short answer
The Digital Infrastructure Act in Singapore is the new licensing law for the country's largest data centres and cloud providers. The Digital Infrastructure Bill was introduced for First Reading on 8 September 2026 and passed by Parliament on 7 October 2026. It will be administered by the Infocomm Media Development Authority (IMDA). As of October 2026, a commencement date has not been announced.
It creates two licensing regimes. The first covers security and resilience: major co-location and cloud data centres with a critical IT load of at least 10 MW, and major cloud service providers whose infrastructure and platform services earn at least S$100 million in average annual revenue from Singapore users over the preceding three years. The second covers environmental sustainability: every data centre operator with a critical IT load of at least 3 MW.
Licensees will face security, business continuity and incident reporting duties, energy-efficiency requirements and, at the top end, financial penalties of up to the higher of S$1 million or 10% of annual Singapore turnover.
Why the law was introduced
The Ministry of Digital Development and Information (MDDI) framed the Bill as strengthening the foundations of the digital economy. Most banking, healthcare, transport and government services now depend on a small number of data centre facilities and cloud platforms. A disruption at one facility can, in the words used during the parliamentary debate, ripple across the economy and society.
The Cybersecurity Act already addresses cyber threats to foundational digital infrastructure. The new law is broader: it targets operational resilience against technical failures, power or cooling problems, fires and other physical incidents, and adds a sustainability regime reflecting the energy and water demands of data centres.
MDDI and IMDA consulted on a draft from 1 to 22 July 2026, received 25 responses and reported broad support for the objectives, with feedback on implementation reflected in the final Bill.
Who needs a licence
The Digital Infrastructure Act in Singapore turns on scale and function, not on corporate form. Two licence types are created, and a single operator can need both.
| Licence | Who is covered | Threshold | Main focus |
|---|---|---|---|
| Major foundational digital infrastructure (FDI) licence: data centres | Major co-location and cloud data centres | Critical IT load of at least 10 MW | Security, resilience, incident reporting |
| Major FDI licence: cloud services | Major cloud service providers offering IaaS and PaaS | At least S$100 million average annual revenue from Singapore users over the preceding three years | Security, resilience, incident reporting |
| Data centre (DC) licence | All data centre operators, existing and new | Critical IT load of at least 3 MW | Energy efficiency, later possibly IT equipment and water efficiency |
Data centres used solely for an operator's own internal purposes are outside the security and resilience regime. Software-as-a-service providers that do not provide infrastructure or platform services are also outside the cloud limb, although they may be affected as customers.
Operating without a required licence is an offence. Groups planning new capacity, acquiring facilities or launching cloud regions should therefore build licensing into transaction timetables in the same way as other regulatory approvals.
Indirectly affected: customers, landlords and investors
Many organisations will feel the Digital Infrastructure Act in Singapore without holding a licence. Banks, insurers, hospitals and CII owners that rely on licensed facilities and cloud platforms will see new incident notifications, audit evidence and possibly user notifications flowing from their providers, and can use these to support their own regulatory obligations.
Landlords of data centre buildings, power and cooling contractors and managed service providers may be asked to support licensees' resilience and energy-efficiency duties through revised contracts. Investors and lenders will want to understand licence status, conditions and change-of-control notification requirements before they commit capital.
Do the threshold arithmetic now. For cloud providers the test uses a three-year average of Singapore-sourced IaaS and PaaS revenue, so how revenue is attributed between group entities and service lines will matter. For data centres, confirm how critical IT load is measured for each facility rather than relying on marketing capacity figures.
Security and resilience duties for major FDI licensees
Holders of the major FDI licence under the Digital Infrastructure Act in Singapore must implement security risk management measures, maintain business continuity and disaster recovery plans, and report specified incidents and service disruptions to IMDA. Codes of practice will set out the detail, including expected security measures, steps to minimise interruptions and the timeframes for incident notification.
IMDA will also be able to issue directions, for example to require audits or remedial action, and the Bill contemplates that licensees may be required to notify affected users of cybersecurity threats. Changes in the ownership or control of a licensee will need to be notified to IMDA, which makes the regime relevant to mergers and acquisitions.
Reporting is meant to be coordinated with the Cybersecurity Act. IMDA is expected to act as the main reporting channel and share information with the Cyber Security Agency of Singapore, and MDDI has said requirements under the two laws will be streamlined. Our note on the Cybersecurity Act and CII obligations explains the CSA side.
Codes, recognised standards and transition
Much of the operational detail will sit in codes of practice rather than the Act itself. Under the Bill, codes do not have legislative effect but licensees must comply with them, and amendments take effect only once notice is published. That gives IMDA flexibility to update requirements as threats and technology change, but it also means licensees must track code changes closely.
MDDI has said it will recognise existing industry standards and certifications where possible, and streamline licensing and reporting. Operators that already hold recognised security or continuity certifications should keep that evidence current, as it may reduce the effort needed to show compliance under the Digital Infrastructure Act in Singapore.
Sustainability duties for data centre licensees
The sustainability limb of the Digital Infrastructure Act in Singapore reflects a policy choice. During the parliamentary debate, the Government indicated that Singapore is not seeking to attract every megawatt of capacity, and that it wants the capacity it hosts to be efficient. All data centre operators above the 3 MW threshold will need a DC licence. Initially, the main requirement is facility-level energy efficiency, measured through power usage effectiveness. The precise thresholds have not yet been fixed, and existing facilities are expected to receive time to meet them.
The framework allows IMDA to add requirements on IT equipment energy efficiency and water efficiency after consulting industry. DC licensees will also have to submit annual compliance reports.
A significant feature for new capacity is that strategic, economic and green energy commitments made when data centre capacity is awarded, for example through the Data Centre Call for Application, can be enforced as licence conditions. Under the Bill, breach of a renewable energy condition can lead to remedies such as the transfer of carbon credits. Bids made in capacity exercises therefore need to be realistic, because they become enforceable obligations under the Digital Infrastructure Act in Singapore.
How to prepare: a practical process
Until IMDA publishes licence application processes and codes, preparation is about evidence and governance. A typical programme looks like this:
- Scope the estate. List every data centre facility and cloud service in Singapore, with critical IT load and attributable revenue, to determine which licences apply.
- Map existing controls. Compare current security, continuity and disaster recovery arrangements with the expected duties, recognising certifications IMDA may accept.
- Build incident reporting. Design a single process that can meet IMDA and CSA requirements without duplicate effort, including triggers for physical and operational incidents.
- Assess energy performance. Measure power usage effectiveness for each facility and identify upgrades older sites may need during any transition period.
- Review commitments. Catalogue green energy, investment and other commitments made in capacity exercises that may become licence conditions.
- Update contracts. Align customer, colocation and supplier contracts with new reporting, audit and user-notification duties.
- Plan for transactions. Add licensing and change-of-control notification to acquisition, financing and joint-venture checklists.
Enforcement, penalties and appeals
The Bill gives IMDA a graduated set of tools. For contraventions of licence conditions, codes or the Act, IMDA can impose a financial penalty of up to the higher of S$1 million or 10% of the licensee's annual turnover in Singapore. Lower maximum penalties apply to failures to comply with directions, and operating without a licence is a criminal offence. IMDA can also suspend or revoke licences, shorten licence terms, modify conditions or censure the licensee.
Licensees will be given notice and an opportunity to make representations before a financial penalty is imposed, and that window is the point at which well-organised compliance records make the greatest difference to the outcome. Decisions can be reconsidered by IMDA and then appealed to the Minister, who may be assisted by an advisory panel.
| Tool | When used | Practical significance |
|---|---|---|
| Directions | To secure compliance, require audits or remedial action | Non-compliance carries its own penalty |
| Financial penalty | Contravention of licence conditions, codes or the Act | Up to the higher of S$1 million or 10% of annual Singapore turnover |
| Suspension or revocation | Serious or persistent breaches and other prescribed grounds | Could affect the ability to operate the facility or service |
| Criminal offence | Operating without a required licence | Fines, including continuing daily fines |
Illustrative scenario: a colocation operator expands
This scenario is illustrative only and uses generic parties. A regional colocation operator runs two Singapore facilities: one with a critical IT load just above 3 MW and a newer site above 10 MW. It is also bidding for additional capacity.
The smaller site will need a DC licence and must meet energy-efficiency requirements. The larger site will need both a DC licence and a major FDI licence, bringing security, business continuity and incident reporting duties. The operator maps its controls against expected requirements, upgrades cooling at the older site and builds a single incident process for IMDA and CSA.
Its largest customer, a regulated financial institution, asks how the new reporting duties will feed into its own outsourcing and incident obligations. The operator offers a contract addendum aligning notification timeframes and evidence-sharing with the codes once published, rather than waiting for each customer to raise the point separately.
For its capacity bid, legal and engineering teams jointly review the green energy and investment commitments, knowing that they may become licence conditions. They also update the share purchase documents for a planned minority investment to cover IMDA change-of-control notification.
Risks and common mistakes
Assuming the law only concerns hyperscalers
The 3 MW sustainability threshold will capture many mid-sized colocation and enterprise facilities that are not hyperscale. Operators of these sites should not assume the law is aimed only at the largest cloud brands. Each facility needs its own threshold assessment.
Treating capacity bid commitments as aspirational
Commitments made to secure new data centre capacity can be enforced as licence conditions. Overly optimistic renewable energy or investment pledges could later become compliance liabilities with financial consequences. Bids should be reviewed by legal as well as commercial teams.
Running two incident processes
Separate teams reporting to IMDA, CSA, the PDPC and sector regulators create delay and inconsistent facts. Build one triage and reporting workflow with regulator-specific outputs. Our cybersecurity and incident response team designs these processes.
Ignoring the effect on customer contracts
Financial institutions, healthcare providers and CII owners will expect their providers to support their own regulatory duties. New licence obligations should be reflected in service descriptions, notification clauses and audit rights. Our cloud and outsourcing practice reviews these terms from both sides.
Cross-border angle and what to do now
Most major cloud and colocation providers in Singapore belong to international groups. The Digital Infrastructure Act in Singapore applies to services and facilities in Singapore, but group policies, global security standards and parent-level contracts will need to accommodate Singapore-specific reporting, change-of-control and sustainability conditions. Investors from Bangladesh, the UK, the UAE and China considering data centre assets should add licensing to due diligence. Our data centres and digital infrastructure practice coordinates that work.
Cross-border cloud architecture raises a further point. The cloud limb is framed around revenue from Singapore users, so a provider serving Singapore customers from regional infrastructure outside Singapore should take advice on whether, and how, the threshold and the related duties apply to its operating model and contracting entities. Finally, groups with facilities in several Asian markets may find it efficient to adopt the most demanding resilience and efficiency standards group-wide, documenting Singapore-specific reporting and licence conditions as local overlays.
- Confirm which facilities and services meet the 3 MW, 10 MW and revenue thresholds.
- Prepare evidence of security, continuity and energy-efficiency controls.
- Align IMDA and CSA incident reporting into one workflow.
- Review capacity commitments that may become licence conditions.
- Update customer, supplier and transaction documents.
- Monitor IMDA for commencement, codes and transition arrangements.
Further background on the related cybersecurity changes is available from the Cyber Security Agency of Singapore. For advice on licensing, a transaction or customer terms under the Digital Infrastructure Act in Singapore, please contact TRW & Co. Related practice areas include telecommunications regulation.
Frequently asked questions
01When does the Digital Infrastructure Act come into force?
As of October 2026, no commencement date has been announced. The Bill passed in Parliament on 7 October 2026 and will take effect on dates notified by the Government. MDDI and IMDA have said existing data centres will receive sufficient transition time, and that detailed requirements will be developed with industry. Operators should monitor IMDA announcements and begin threshold assessments and control mapping now.
02Does my data centre need a licence under the Digital Infrastructure Act?
If your facility has a critical IT load of at least 3 MW, you will need a data centre licence focused on sustainability. If it is a major co-location or cloud data centre with at least 10 MW of critical IT load, you will also need a major foundational digital infrastructure licence covering security and resilience. Facilities used solely for an operator's own internal purposes are excluded from the security and resilience regime.
03Which cloud providers are covered?
The security and resilience regime covers major cloud service providers whose infrastructure-as-a-service and platform-as-a-service offerings generate at least S$100 million in average annual revenue from Singapore users over the preceding three years. Smaller providers and pure software-as-a-service providers are outside that limb, though they may be affected through contracts with licensed providers or regulated customers.
04What are the penalties under the Digital Infrastructure Act?
Under the Bill, IMDA can impose financial penalties of up to the higher of S$1 million or 10% of annual Singapore turnover for contraventions, with lower maximums for failing to follow directions. Operating without a required licence is a criminal offence. IMDA may also suspend or revoke a licence, shorten its term or modify conditions. Licensees can seek reconsideration and then appeal to the Minister.
05How does the Digital Infrastructure Act relate to the Cybersecurity Act?
They are complementary. The Cybersecurity Act addresses cybersecurity of critical systems and foundational digital infrastructure, overseen by CSA. The Digital Infrastructure Act addresses wider operational resilience, including physical incidents, and sustainability, overseen by IMDA. The Bill includes related amendments to the Cybersecurity Act, and the Government has said requirements and incident reporting will be streamlined between the two.
Sources and official materials
- MDDI: New Digital Infrastructure Bill to strengthen the foundations for Singapore's digital economy — Licensing regimes, thresholds and transition
- Digital Infrastructure Bill (Bill No. 20/2026) — Bill text, licence types, penalties and appeals
- MDDI: Public consultation on the Digital Infrastructure Bill — Consultation on the draft Bill
- Infocomm Media Development Authority — Regulator administering the licensing regimes
- CSA: Cybersecurity (Amendment) Act provisions in force — Related cybersecurity obligations
General information only, current as at 20 October 2026. It is not legal advice and does not create a lawyer–client relationship. Singapore law and regulatory practice change; check current official sources and take advice on the facts of your matter.
