Parliament passed the Digital Infrastructure Bill on Tuesday, giving the Infocomm Media Development Authority (IMDA) power to license large data centres, harmonise cyber-incident reporting with the Cyber Security Agency, and fine operators up to S$1 million or 10 per cent of Singapore turnover when resilience rules are breached.
The law lands as Singapore’s 70 data centres shoulder more AI and cloud load, and as MPs debated whether tighter security would slow the republic’s digital economy. Minister for Digital Development and Information Josephine Teo told the House that about two-thirds of local facilities cross revenue or power thresholds that trigger foundational digital infrastructure licensing, reflecting how concentrated the sector has become.
What operators must now prove
Under the Bill, major sites must show they can recover from misconfiguration, fire, flood and power loss, not only defend against hackers. IMDA will issue foundational digital infrastructure licences for operators above S$100 million in average annual revenue from Singapore users over three years, or those drawing at least 10 megawatts of electrical capacity. Separate data centre licences apply once a facility uses 3 megawatts or more.
Amendments to the Cybersecurity Act fold those operators into mandatory cyber-incident reporting, aligning timelines with the new licensing regime so firms are not caught between two incompatible clocks. During the debate, several MPs asked how energy-efficiency commitments in the Bill would interact with Singapore’s green-data-centre push; the ministry said efficiency metrics will sit alongside security and continuity obligations rather than replace them.
Why the fines are sized this way
IMDA’s penalty ceiling matches the seriousness ministers attach to outages at facilities that back banks, hospitals and government services. The agency can also act when operators miss economic commitments tied to their licences, a lever used when Singapore courts hyperscale investment.
For town councils and HDB residents, the Bill is indirect but real: resident portals, lift monitoring and PayNow rails increasingly ride on Singapore-hosted compute. A prolonged blackout at a licensed hall is less a “tech story” than a household-services interruption, which is why the law treats continuity planning as licence table stakes.
What happens next
IMDA will publish subsidiary regulations and consultation papers on licence conditions; operators above the thresholds should expect onboarding interviews rather than a simple online form. Smaller co-location suites below 3 megawatts remain outside the DC licence class but may still face customer contracts that flow down foundational requirements from anchor tenants.
Opposition and backbench questions focused on whether foreign-owned operators could appeal penalties through offshore parents. The ministry’s answer, repeated in committee, is that Singapore turnover and local licences keep enforcement rooted here even when branding is global.