TRW & Co · Technology, IP & Data
Data Centres and Digital Infrastructure in Singapore
Data centre law in Singapore now combines capacity allocation, efficiency and green energy standards, cybersecurity duties and a new licensing regime under the Digital Infrastructure Bill. This guide explains who needs a licence, how new capacity is won, what DC-CFA2 demands, and how operators, investors and customers should structure power, construction and colocation contracts.
Key pointUnder the Digital Infrastructure Bill, commitments made to win data centre capacity, including green energy pledges, can be enforced as licence conditions, so every promise in a bid must be backed by contracts that can deliver it.
At a glance
Two new licences
The Digital Infrastructure Bill, passed in October 2026, licenses data centres of at least 10 MW and major cloud providers for resilience, and all operators of 3 MW or more for sustainability.
Capacity is allocated
EDB and IMDA launched DC-CFA2 on 1 December 2025, releasing at least 200 MW, with more possible for projects using new green energy pathways.
Demanding efficiency targets
DC-CFA2 requires a facility PUE of 1.25 or better at full IT load and BCA-IMDA Green Mark for Data Centres 2024 Platinum certification.
Half from green pathways
At least 50% of new DC-CFA2 capacity must be powered by eligible pathways such as biomethane, low-carbon ammonia or hydrogen, or building-integrated solar.
Cybersecurity overlay grows
2024 Cybersecurity Act amendments in force since 31 October 2025 let third-party systems be designated as CII; CII owners must report incidents within two hours.
Swipe or scroll →
What data centre law in Singapore covers
Data centre law in Singapore brings together capacity allocation, licensing, cybersecurity, energy, land and contracts. A data centre cannot simply be built where land is available: new capacity is allocated through government calls for application, operators must meet demanding efficiency and green energy standards, and the largest facilities and cloud providers are now moving into a dedicated licensing regime.
The subject affects developers and operators, hyperscale cloud providers, colocation customers, investors and lenders, and the banks, hospitals and digital platforms whose services run inside these buildings. MDDI has noted that Singapore hosts more than 1.6 GW of data centre capacity, which makes the sector both strategically important and closely watched.
The past few years have shown why. Power surges, cooling failures and a fire at data centres disrupted cloud, banking and payment services, and those incidents shaped the new rules on resilience.
The legal and regulatory framework
There is no single data centre statute that has been in force for years. Instead, several regimes apply together, and a new one is now arriving.
| Regime | Lead agency | What it does | Who it reaches |
|---|---|---|---|
| Digital Infrastructure Bill (passed October 2026) | IMDA, with MDDI policy | Licensing for security and resilience, and for environmental sustainability | Data centres of at least 10 MW critical IT load and major cloud providers (resilience); operators of at least 3 MW (sustainability) |
| Data Centre Call for Application | EDB and IMDA | Allocates new data centre capacity against strategic, economic and sustainability criteria | Applicants for new capacity |
| Cybersecurity Act 2018 (as amended in 2024) | Cyber Security Agency | Critical information infrastructure duties; new category for foundational digital infrastructure | CII owners and, once in force, major digital infrastructure providers |
| Personal Data Protection Act 2012 | PDPC | Protection, transfer and breach notification for personal data | Customers and, where they process data, operators |
| Planning, building and energy laws | URA, BCA, EMA, NEA, SCDF | Land use, building approvals, power connection, carbon and fire safety | Developers and operators |
Customers in regulated sectors bring their own regulators into the picture. A bank's use of a data centre or cloud region is assessed against MAS technology risk and outsourcing expectations, which flow down into colocation and cloud contracts; our guide to outsourcing risk explains how.
The Digital Infrastructure Bill
MDDI introduced the Digital Infrastructure Bill for first reading on 8 September 2026 after a public consultation in July 2026, and Parliament passed it in October 2026. According to MDDI's announcement, it creates two licensing regimes administered by IMDA.
Security and resilience licensing
The first regime covers co-location and cloud data centres with a critical IT load of at least 10 MW, and major cloud service providers whose infrastructure and platform services earn at least S$100 million in average annual revenue from Singapore users over the preceding three years. Licensees must implement security risk management measures and business continuity and disaster recovery plans, and report specified incidents and disruptions to IMDA. The focus is operational risk: technical failures, power and cooling problems, fires and similar physical incidents.
Sustainability licensing
The second regime requires all data centre operators with a critical IT load of at least 3 MW, existing and new, to be licensed for environmental sustainability. Facility-level energy efficiency requirements, including power usage effectiveness (PUE), come first; IT equipment and water efficiency requirements may follow after industry consultation. Commitments made when winning new capacity, including green energy commitments, can be enforced as licence conditions.
Data centres used solely for an operator's own internal purposes are outside the Bill. Commencement and transition dates are to be announced, and MDDI has said existing facilities will receive sufficient transition time.
A promise made to win capacity is no longer just a bid commitment: under the new regime it can become a licence condition.
Capacity allocation: the Data Centre Call for Application
New capacity is released through competitive calls run by EDB and IMDA. The second Data Centre Call for Application (DC-CFA2) was launched on 1 December 2025 and makes at least 200 MW available, with possibly more for projects using new green energy pathways, according to IMDA's factsheet.
Applicants are assessed on strategic value (for example, strengthening Singapore as a trusted hub for AI, connectivity and resilience), economic contribution (investment, business spending, R&D and talent) and sustainability. The sustainability requirements are specific:
- A facility-level PUE of 1.25 or better at 100% IT load.
- BCA-IMDA Green Mark for Data Centres 2024 Platinum certification.
- IT equipment meeting or exceeding SS 715:2025, with measures to optimise utilisation.
- At least 50% of the new capacity powered by eligible green energy pathways, such as biomethane, low-carbon ammonia or hydrogen, novel fuel cells with carbon capture, or building-integrated solar.
Companies with differentiated propositions can also approach EDB under the Strategic Digital Infrastructure Scheme, described in EDB's announcement. Both routes are competitive, and neither guarantees an allocation. Either way, the bid becomes the regulatory baseline for the life of the facility. Details of the current call, including registration and contacts, are on IMDA's DC-CFA2 page.
Building a credible bid
The strongest applications treat the bid as a contract in waiting. Each commitment on investment, efficiency, green energy and local capability should be traceable to a supplier, a design assumption or a board approval. Evaluators look for realism as well as ambition, and the hardest questions usually concern green energy: which pathway, from which supplier, from what date and with what fallback if a novel technology is delayed. Under data centre law in Singapore, the answer to those questions can later be tested against licence conditions, so it pays to document the reasoning now.
Cybersecurity, power and sustainability duties
Two further areas of data centre law in Singapore sit outside the new Bill but bite just as hard in practice: cybersecurity duties that follow critical systems into the facility, and the energy and carbon rules that govern how the facility is powered.
Cybersecurity and critical information infrastructure
The Cybersecurity Act 2018 imposes duties on owners of critical information infrastructure (CII) in essential service sectors. Amendments passed in May 2024 widened its reach. Provisions in force from 31 October 2025 allow systems supplied by third parties to essential service providers, including systems located overseas, to be designated as CII, and expand the incidents that must be reported. CII owners must notify CSA of reportable incidents within two hours of becoming aware of them.
The amendments also create a category of foundational digital infrastructure, aimed at cloud service providers and data centres, with duties to follow cybersecurity codes and report prescribed incidents. At the time of writing, those provisions had not been brought into force, and MDDI has said it will streamline requirements under the new Bill and the Cybersecurity Act. Operators hosting CII for customers should expect contractual demands for incident cooperation now, ahead of any direct obligations. See our cybersecurity and incident response page for incident planning.
Power, carbon and green energy
Power is the binding constraint on data centre growth. Data centre law in Singapore therefore links capacity awards to energy efficiency and green energy, and operators must plan electricity supply as carefully as land. Large sites need grid connection arrangements with the transmission licensee, electricity retail contracts and, increasingly, long-term green power or certificate purchases.
Green energy commitments are often met through a mix of on-site solar, renewable energy certificates and import or low-carbon fuel pathways. Our pages on energy projects and renewable energy contracts explain the licensing and contract structures, and our guide to power purchase agreements covers offtake terms.
Carbon pricing also matters. Large emitting facilities are subject to the carbon tax regime administered by NEA, and even where a data centre sits below the reporting threshold, its customers increasingly ask for emissions data for their own sustainability reporting.
Write the PUE, green energy and Green Mark commitments into the construction, power and customer contracts, not just the bid. If a cooling design change or a delayed green power supply puts a licence condition at risk, the contracts should already say who must fix it, who pays and how customers are told.
Process: from capacity bid to operation
- Frame the proposition. Define the facility's capacity, customer base, AI and connectivity role, and the green energy pathway, against DC-CFA criteria or an EDB scheme.
- Secure land and planning. Obtain the site through a land tender, lease or acquisition, and confirm permitted use and planning parameters with URA and the landlord.
- Bid for capacity. Submit the application with investment, sustainability and economic commitments that the project can actually deliver.
- Lock in power. Agree grid connection and supply arrangements, green power procurement and any on-site generation or storage.
- Design and build. Let EPC or design-and-build contracts tied to PUE, Green Mark and resilience specifications, with testing and performance guarantees.
- Licence and certify. Obtain the licences required under the new regime once in force, Green Mark certification and building and fire safety approvals.
- Contract with customers. Put colocation, wholesale or cloud agreements in place with service levels, incident cooperation and regulatory flow-downs.
- Operate and report. Monitor efficiency, report incidents to IMDA and CSA where required, and keep evidence of compliance with licence conditions.
Key contracts and commercial decisions
Colocation and wholesale agreements
Allocate power density, cooling, uptime, maintenance windows and incident notification. Customers in regulated sectors will require audit and regulator access rights.
Build-to-suit and leases
Hyperscale tenants often take whole buildings. Lease terms must address fit-out, power upgrades, reinstatement and how licence obligations are split between landlord and tenant.
EPC and equipment
Construction contracts should carry performance guarantees on PUE and resilience, with delay damages linked to capacity commitments.
Power and green energy
Long-term supply, green certificates and novel fuel pathways need firm delivery terms, because shortfalls can now breach licence conditions.
Financing
Lenders test capacity allocation, licence risk and customer contracts. Our project finance and green finance teams align security and sustainability-linked terms.
Cloud and data terms
Cloud providers and their customers need clear terms on data location, access and breach handling; our guide to cloud data covers the PDPA angle.
Documents and evidence to assemble
- The capacity application and award letter, with all strategic, economic and green energy commitments listed.
- Land, lease and planning documents showing permitted data centre use.
- Design documents, PUE modelling, Green Mark submissions and commissioning test results.
- Power connection, supply and green energy contracts, including certificate registries.
- Business continuity, disaster recovery and security risk management plans.
- Incident logs, root cause analyses and notifications made to customers and regulators.
- Customer contracts, with a schedule of regulatory flow-down obligations by customer sector.
These records also support investment and sale processes, where buyers test whether capacity awards and licence conditions transfer cleanly with the asset.
Risks and common mistakes
Over-promising in the capacity bid
Capacity calls reward ambitious commitments on efficiency, green energy and investment. Under the new regime, those commitments can be enforced as licence conditions. Bidders that rely on unproven fuel pathways or optimistic PUE modelling risk breaching conditions once the facility operates under real loads and tropical conditions. Stress-test each commitment with engineers and energy suppliers, and make sure the delivery chain is contractually committed before the bid is submitted.
Assuming small facilities are unaffected
The security and resilience licence applies at 10 MW critical IT load, but the sustainability licence reaches every operator at 3 MW and above, including existing facilities. Smaller colocation operators and enterprise-owned sites offering capacity to third parties may fall within it. Only facilities used solely for the operator's own internal purposes are excluded. Check each site's critical IT load and use now, rather than waiting for commencement.
Weak incident cooperation clauses
When a data centre fails, customers face their own reporting duties, such as a bank's obligations to MAS or a CII owner's two-hour notification to CSA. If the colocation contract does not require prompt, detailed incident information and cooperation with investigations, the customer is exposed and the operator faces claims. Agree notification timelines, information to be provided and post-incident reports in advance, aligned with each regime that applies.
Treating sustainability as a reporting exercise
Efficiency and green energy are moving from voluntary targets to enforceable licence conditions. Operators that treat PUE as a marketing metric rather than an operational limit can be caught out when customer loads, especially AI workloads with high power density, change the profile of the facility. Monitor efficiency continuously, plan upgrades, and make sure customer contracts allow the operator to manage loads in a way that keeps the facility compliant.
Missing change-of-control conditions
Data centre assets change hands frequently. Capacity awards, land leases, power contracts and customer agreements often contain consent rights or conditions triggered by a change of control, and licences under the new regime may carry similar terms. Buyers that discover these late may face delays or renegotiation. Map consents early and build them into the transaction timetable.
The cross-border angle
Many operators run regional platforms that place capacity in Singapore alongside Johor, Batam and other ASEAN locations. Data centre law in Singapore applies to facilities in Singapore, but customer contracts often span several countries, and data transfer, latency and resilience planning must work across all of them. Choices about where to host data also raise PDPA transfer obligations, explained by the PDPC, and the data localisation rules of other countries.
Cross-border structures also affect resilience planning. A customer that relies on a Singapore facility for primary workloads and a facility abroad for disaster recovery needs both contracts to work together, with consistent incident definitions, notification timelines and testing rights. Where the two facilities sit under different regulators, the stricter regime usually sets the standard the customer must meet, and contracts should be drafted with that in mind.
For groups from the UK and Europe, Singapore's approach of allocating capacity rather than leaving it to the market is the main difference to plan for. Investors from the UAE and China are active in the sector and will face security and resilience scrutiny. Bangladesh-linked businesses using Singapore facilities for regional services should check Bangladesh data rules alongside Singapore requirements.
How TRW & Co helps
We advise on data centre law in Singapore for developers, operators, investors and customers, working across our technology, energy, real estate and finance teams. Typical workstreams include:
- Capacity and licensing strategy. Structuring DC-CFA bids and preparing for licensing under the new regime.
- Project documents. Land, construction, power and green energy contracts aligned with licence conditions.
- Customer contracts. Colocation, wholesale and cloud and outsourcing agreements with regulatory flow-downs.
- Transactions and financing. Diligence, consents and security packages for acquisitions and financings.
- Resilience and incidents. Continuity planning, incident response and regulator engagement, coordinated with our telecommunications regulation work.
Where Singapore court or tribunal representation is required, we work alongside Singapore-qualified counsel. See our full range of practices.
Checklist for decision-makers
- What is the critical IT load of each facility, and which licensing regime will apply?
- Are capacity award commitments recorded and backed by enforceable supply and construction contracts?
- Can the facility meet PUE and Green Mark targets under realistic and AI-driven loads?
- Is green energy supply contracted, and who bears the risk of shortfall?
- Do continuity, disaster recovery and security plans meet the expected licensing standards?
- Do customer contracts cover incident notification, cooperation and regulator access?
- Are any systems hosted for CII owners, and are reporting chains in place?
- Have change-of-control consents been mapped for any planned investment or sale?
To discuss data centre law in Singapore for a project, acquisition or customer arrangement, contact us at info@trw.co.
Frequently asked questions
01Which data centres need a licence under the new regime?
Under the Digital Infrastructure Bill, co-location and cloud data centres with a critical IT load of at least 10 MW, and major cloud service providers earning at least S$100 million in average annual revenue from Singapore users, will need a security and resilience licence. All data centre operators with a critical IT load of at least 3 MW, existing and new, will need a sustainability licence. Facilities used solely for the operator's own internal purposes are excluded. Commencement dates are still to be announced.
02How do we obtain new data centre capacity in Singapore?
New capacity is mainly allocated through the Data Centre Call for Application run by EDB and IMDA. The second call, launched on 1 December 2025, offers at least 200 MW. Bids are assessed on strategic value, economic contribution and sustainability, including PUE, Green Mark and green energy requirements. Companies with differentiated propositions can also approach EDB under the Strategic Digital Infrastructure Scheme. Expect commitments in the bid to become licence conditions later.
03What does PUE 1.25 mean in practice?
Power usage effectiveness compares total facility energy use with the energy used by IT equipment. A PUE of 1.25 means that for every unit of energy consumed by servers, only a quarter of a unit more is used for cooling, power conversion and other overheads. Achieving it in Singapore's climate at full load requires efficient cooling design, careful operations and suitable customer load profiles, so it should be modelled and contracted, not assumed.
04Do cloud customers have any obligations under these rules?
The licensing duties fall on operators and major cloud providers, but customers are affected. Regulated customers, such as financial institutions and CII owners, have their own technology risk, outsourcing and incident reporting duties, which they pass down through contracts. Customers should check that their data centre and cloud agreements provide incident information, audit and regulator access, and continuity arrangements that match their own obligations and the new regime.
05How does the Cybersecurity Act apply to data centres?
Amendments passed in 2024 allow systems supplied by third parties to essential service providers, including overseas systems, to be designated as critical information infrastructure, and widen incident reporting. Those provisions took effect on 31 October 2025. The amendments also created a foundational digital infrastructure category for cloud providers and data centres, which at the time of writing had not been brought into force. MDDI has said requirements under the new Bill and the Cybersecurity Act will be streamlined.
06Can green energy commitments be met with certificates?
That depends on the pathway accepted in the capacity award. DC-CFA2 specifies eligible pathways for at least half of new capacity, including biomethane, low-carbon ammonia or hydrogen, novel fuel cells with carbon capture, and building-integrated or building-applied solar. Renewable energy certificates and imports may form part of a wider strategy, but operators should confirm with IMDA and EDB which arrangements satisfy their specific commitments before relying on them.
Sources and official materials
- MDDI: New Digital Infrastructure Bill — Licensing regimes, thresholds and transition
- IMDA: Launch of second Data Centre Call for Application — DC-CFA2 capacity and sustainability criteria
- IMDA: Call for Application Data Centre 2 — DC-CFA2 application page
- EDB: Launch of second Data Centre Call for Application — EDB announcement and SDIS
- CSA: Cybersecurity Act — CII duties and foundational digital infrastructure
General information only, current as at 20 October 2026. It is not legal advice and does not create a lawyer–client relationship. Singapore law and regulatory practice change; check current official sources and take advice on the facts of your matter.
