In brief
On 7 October 2026, Parliament passed the Digital Infrastructure Bill ("Bill"), which the Ministry of Digital Development and Information (MDDI) first introduced on 8 September 2026.
The Bill establishes two new separate licensing regimes administered by the Infocomm Media Development Authority (IMDA) to enhance (i) the security and resilience of major cloud services and data centres (DCs); and (ii) the environmental sustainability of DC operations in Singapore. Qualifying operators may require both licences. The Bill also allows for strategic, economic and sustainability commitments made in securing new DC capacity to be enforced as licence conditions. It also supplements existing cybersecurity requirements under the Cybersecurity Act 2018.
Existing service providers and DC operators will have a six-month transition period from the commencement date to apply for the relevant licence(s).
In more detail
According to MDDI's press release, the Bill seeks to give businesses assurance that the digital infrastructure they depend on is secure and resilient, while ensuring that Singapore's DC sector grows sustainably given its reliance on scarce land, power and water.
Security and resilience licensing threshold
A major foundational digital infrastructure (FDI) licence will be required for:
- Major co-location and cloud DCs with a critical IT load of at least 10 megawatts (MW), excluding DCs used solely for the operator's own internal purposes
- Major cloud service providers (CSPs) whose Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS) services generate at least SGD 100 million in average annual revenue from users in Singapore over the three preceding years
These thresholds are calibrated to cover DCs and CSPs whose disruption would have a significant impact on Singapore's economy and society. Licensees will be required to address operational resilience risks, such as technical failures, power or cooling issues and fires, and implement physical security risk management measures, prescribed business continuity and disaster recovery plans, and report specified incidents and disruptions to IMDA.
Environmental sustainability licensing threshold
All operators of DCs in Singapore with a critical IT load of at least 3MW will require a DC licence, whether the operator is located in or outside Singapore. A person is treated as operating a DC if it controls the introduction and implementation of the DC's operating, maintenance or environmental policies, and where more than one person does so, the person with the greatest such authority is the operator.
As a first step, existing and new DCs will be required to meet facility-level energy-efficiency requirements, including Power Usage Effectiveness (PUE) requirements. Further requirements, including for equipment-level energy efficiency and facility-level water efficiency, may be subsequently introduced following consultation with industry. DC licensees will also be subject to reporting obligations for specified changes in equity ownership or control.
Capacity commitments
The Bill provides a basis for strategic, economic and green energy commitments made in exchange for new DC capacity, such as through the Data Centre – Call for Application (DC-CFA), to be enforced as licence conditions. Each DC licence will also specify the critical IT load at which the DC may be operated.
Enforcement powers
Under both licensing regimes, non-compliance may attract financial penalties of up to the higher of SGD 1 million or 10% of the licensee's annual turnover in Singapore. IMDA may also require compliance with additional codes of practice and directions, impose new licensing conditions, reduce the critical IT load at which the DC may be operated, and/or suspend or revoke the licence(s).
Existing major FDI service providers and DC operators in Singapore may continue services and operations for six months from the commencement of Parts 3 and 4 of the Act. If they apply for a licence within this transition period, they may continue until IMDA grants the licence or the application is finally refused or withdrawn. MDDI and IMDA have also committed to providing sufficient transition time for existing DCs to meet regulatory requirements, and to recognising existing industry standards and certifications where possible.
Key takeaways
The Bill’s commencement date has yet to be announced, and detailed requirements will be set out in subsidiary legislation and codes of practice. Given the six-month application window, DC operators and major FDI service providers should start preparing now, including by:
- Mapping whether their DCs or cloud services fall within either or both licensing regimes, based on critical IT load and average annual Singapore revenue from IaaS and PaaS services
- Reviewing commitments made in securing DC capacity, as these may become enforceable licence conditions
- Reviewing existing security, business continuity, disaster recovery and incident reporting processes against the new requirements
We would be pleased to assist with assessing whether your operations fall within the new regimes, preparing licence applications and reviewing your compliance frameworks.
For more information on how this may affect your business or potential investments involving DCs and major FDI service providers, please reach out to your usual Baker McKenzie contact.
* * * * *
© 2026 Baker & McKenzie. Wong & Leow. All rights reserved. Baker & McKenzie. Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "principal" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.