Summary

  • Singapore's passed Digital Infrastructure Bill separates data-centre sustainability from the resilience of major services: the principal thresholds are 3 MW, 10 MW and, for large regulated cloud services, S$100 million in average annual Singapore-user revenue.
  • Implementation is expected in stages from 2027. Detailed rules must distinguish the equipment an operator controls from customer servers, and a better efficiency ratio from lower overall resource use.

A cooling fault inside a data centre can travel a long way without leaving the building. In October 2023, a disruption in Singapore affected banking and payment services for more than 12 hours. The government's account puts the damage at 2.5 million failed payment and ATM transactions. Those are transactions, not a count of people; the figure still explains why a room full of cooling equipment belongs in a debate about everyday services.

Singapore's Parliament passed the Digital Infrastructure Bill on 7 October 2026. It gives IMDA a framework for licensing major infrastructure services and data-centre operators. The point is not simply to count buildings. It is to identify which failures can spread widely, who has the means to prevent them, and how much electricity those buildings consume along the way.

One site, two different questions

The first threshold is 3 MW of critical IT load: the maximum power a facility is designed to supply to its IT and network equipment. This is a design measure, not this morning's meter reading, and not the power requirement of the entire building including cooling.

At that threshold, an in-scope Singapore data centre enters the sustainability licensing framework. Commercial facilities used for an enterprise's own computing can qualify too. The Bill also contains specific exceptions, including certain government, public-authority, research and dedicated licensed-utility facilities. It does not exempt commercial hosts merely because some of their customers are government agencies.

At 10 MW, the separate major data-centre facility-service regime comes into view, covering qualifying colocation and cloud facilities serving other parties. Here the concern is continuity: physical and cyber security, recovery arrangements and reporting incidents. A purely internal facility is treated differently under the service definition; the 3 MW sustainability test should not be mistaken for the 10 MW service test.

Cloud has another route into the major-service regime. IaaS and PaaS services qualify at an average of at least S$100 million in annual revenue from Singapore users over the preceding three years. SaaS is outside this particular definition. The test concerns the service's reach into the economy, not the electricity used at a single site.

The government estimates that Singapore has about 70 data centres and roughly two-thirds meet the 10 MW threshold. That establishes the intended scale of supervision, not a verified list of every future licensee.

A server cabinet is also a boundary of responsibility

A colocation operator can maintain cooling, distribute power and control entry to the building. Its customer may own the servers and decide when to replace them. The two have a shared interest in keeping services running, but they do not have interchangeable powers.

MDDI and IMDA's consultation response recognises that distinction. Facility resilience duties are meant to cover the operator's direct control, not customer equipment beyond it. Separate Codes of Practice are planned for cloud and colocation facilities. Guidance will also have to explain which entity exercises effective control inside a complex corporate group.

The distinction matters for energy efficiency as well. Initial requirements will focus on the facility, including power usage effectiveness, or PUE: total facility energy divided by energy used by IT equipment. A value nearer one means less overhead. It does not tell us whether total electricity demand is falling. More computing can outweigh the savings from better cooling.

Nor does PUE measure water use or carbon emissions. Mandatory IT-equipment efficiency requirements are not planned at the outset, partly because a host may not control its customers' machines. Further water-efficiency requirements will need consultation. None of that means other existing environmental rules disappear.

The application window is not a repair deadline

In the closing debate, Tan Kiat How said staged commencement was expected in 2027, as subsidiary legislation, codes and licensing processes are completed. Passage is not proof that those obligations have already commenced. Existing operators would have six months from the relevant commencement date to apply; timely applicants could continue while the application is considered, until grant, final refusal or withdrawal. That is not a blanket six-month deadline for every technical upgrade.

Reporting is another place where a small qualification matters. Where cybersecurity reporting requirements overlap and are similar, licensees are to report to IMDA, which will share relevant information with CSA. This is an attempt to reduce duplication, not permission to disregard every other reporting duty.

Lu Heng's Note 64 offers a useful comparison: decide what needs to be common and what can be left to later choices. But his proposal concerns voluntary Internet coordination. Singapore's applicable statutory codes will be binding; operators cannot opt out simply by preferring another approach.

The remaining work is less visible than a parliamentary vote. A recovery plan must match the equipment people can actually operate. IMDA needs to see shared dependencies that an individual provider may miss. For anyone waiting for a payment to go through, a licence is useful only if that work helps the service recover.

Sources