Data centre operators seek adequate time to meet green targets under new Bill

SINGAPORE - Data centre operators have asked for sufficient time to meet new energy-efficiency requirements under proposed new laws to ensure that critical digital infrastructure remains sustainable and resilient.

Providing adequate time for the transition was among several issues raised during a public consultation on the draft Digital Infrastructure Bill from July 1 to 22, which drew 25 responses from data centre operators, cloud service providers and industry associations.

Overall, respondents supported the new Bill, which they said was important given the role of digital infrastructure in supporting Singapore’s digital way of life. Data centre capacity increase must also come sustainably to conserve Singapore’s scarce natural resources.

The new legislation was tabled in Parliament on Sept 8. If passed, major data centre operators and cloud service providers would have to obtain a license to operate by mid-2027. They would also need to meet power efficiency, incident reporting and security requirements, which will be finalised from next year and updated as technology evolves.

Licenced data centre and cloud service operators could be fined up to $1 million, or up to 10 per cent of their annual turnover in Singapore, whichever is higher, if they fail to meet cybersecurity, business continuity and incident reporting requirements under the proposed new legislation.

The move comes as Singapore is increasingly digitalised, and services offered by data centres and cloud operators power everything from digital banking to ride hailing and e-commerce. At the same time, demand for data centre capacity is growing with the push to adopt artificial intelligence.

In a closing note on the public consultation, the Ministry of Digital Development and Information (MDDI) and Infocomm Media Development Authority (IMDA) said that resource-constrained Singapore needs to grow its compute and data centre capacity in a disciplined manner as such facilities are intensive users of land, power and water.

“Scarce resources must be managed carefully as compute demand grows, so that we make the best use of the resources we have to build the infrastructure Singapore needs, while improving resource efficiency and ensuring that scarce resources generate lasting value,” said MDDI and IMDA.

The Bill will introduce two licensing regimes: one for foundational digital infrastructure (FDI) and another for data centre (DC).

Data centres that require 10 megawatts (MW) of electrical power to operate their essential computing equipment, and cloud service providers that generate more than an average annual revenue of $100 million in Singapore users over three years will need to apply for an FDI licence.

FDI licensees will need to physically and digitally secure their services, have business continuity and disaster recovery plans, and notify IMDA of cybersecurity incidents or service disruptions.

Details, which are still being worked out, will take reference from advisory guidelines introduced in February 2025 for data centre operators and cloud service providers.

Advisory guidelines introduced earlier require data centres to have fire and flood mitigation measures to minimise service disruptions, as well as safeguards against supply chain attacks, malware and ransomware. Cloud service providers also need to strengthen controls over privileged accounts and user access, and maintain audit logs to detect and investigate security incidents.

DC licensees are those that use at least 3MW of electricity to power their essential computing equipment like servers, storage drives and networking hardware.

DC licensees will also need to meet power usage effectiveness (PUE) requirements, which measure how efficiently a data centre uses energy. A score that is closer to 1 indicates greater efficiency.

The PUE requirement has yet to be determined. Meanwhile, data centre contracts awarded to operators in July 2023 had a PUE requirement of 1.3. Proposals selected in August 2026 had a requirement of 1.25.

US-based data centre Digital Realty, which took part in the public consultation, had asked for sufficient time to meet new energy requirements.

Serene Nah, managing director and Asia-Pacific head of Digital Realty, said: “A transition period is necessary because it lets us assess sites properly and make upgrades in a structured, non-disruptive way.”

The operator has three data centres in Singapore. Two of them have PUE ratings close to 1.3. The third data centre, which begun operating in 2011, has a PUE rating above 1.3.

There are currently about 70 data centres in Singapore. It is estimated that about two thirds of them will require both the DC and FDI licenses.

During the consultation, several respondents called for the Government to streamline the license application and renewal process, as well as auditing and reporting requirements.

Responding, MDDI and IMDA said: “We are exploring the streamlining of processes such as a single application form and documentation for all DCs and FDI services covered under (the new law), and will be working with the industry to ensure that these are practical for licensees.”

Respondents said that some FDI licencees could be subject to both the DIA and the Cybersecurity Act, resulting in duplication of obligations. The Cybersecurity Act also requires operators of critical information infrastructure to report cyber security incidents including malware infections and denial-of-service attacks.

Responding, MDDI and IMDA said that they and CSA will streamline the requirements, compliance and operational processes under both the Digital Infrastructure Act and Cybersecurity Act.

Where reporting requirements for cybersecurity incidents are similar, licensees will only need to report to IMDA, with the understanding that relevant information will be shared with CSA, MDDI and IMDA said.