Singapore Passes Bill to Address Risks Behind Digital Service Outages

The new legislation directly responds to past incidents, such as a major banking outage in October 2023 caused by a cooling system failure at a Singapore data center. That incident resulted in over 810,000 failed access attempts and 2.5 million failed payment and ATM transactions, according to the Ministry of Digital Development and Information (MDDI). The bill addresses operational risks like power outages, cooling failures, and fires, complementing existing cybersecurity requirements.

The first licensing regime targets major co-location and cloud data centers with critical IT loads of at least 10 megawatts (MW), and cloud providers whose Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS) services generate at least S$100 million in average annual revenue from Singapore users over three years. Licensed operators under this regime must manage security risks, minimize disruptions, maintain recovery plans, and report specified incidents to IMDA. Breaches can incur penalties up to S$1 million or 10 percent of an operator’s annual Singapore turnover, whichever is higher.

A second regime requires data centers with a critical IT load of at least 3MW to obtain a license and meet energy efficiency standards. This applies to both new and existing facilities, with the possibility of further requirements for IT equipment and water efficiency. Existing operators will have six months from the effective date of the relevant provisions to apply for a license. This broader scope reflects Singapore's effort to strengthen resilience while managing growing demand for land, power, and water, given its more than 1.6 gigawatts of data center capacity.