Digital Infrastructure Bill Consultation

Singapore's Digital Infrastructure Bill was released as a draft for public consultation by the Ministry of Digital Development and Information (MDDI) and the Infocomm Media Development Authority (IMDA) on 1 July 2026. The proposal would create licensing and resilience requirements for major data-centre facility services and cloud-computing services, and baseline environmental-sustainability requirements for data-centre operators. The consultation document and draft Bill are proposals only; they do not represent final legislation or current legal duties until enacted and commenced (MDDI and IMDA, 1 July 2026).

Policy purpose and relationship to existing rules

MDDI and IMDA frame the Bill around three objectives: maintaining security and resilience for major data-centre and cloud services, improving regulatory visibility of cybersecurity incidents and service disruptions, and raising baseline environmental-sustainability standards across the data-centre sector. The proposal is intended to complement the Cybersecurity Act amendments that address cybersecurity risks for major foundational digital infrastructure services, because the agencies say there was not yet a statutory framework covering broader operational resilience. It is therefore a proposed sector framework, not a replacement for the Cybersecurity Act, the Green Data Centre Roadmap or the Data Centre Call for Application (DC-CFA) process (MDDI and IMDA, 1 July 2026).

Major foundational digital infrastructure service thresholds

The draft would define specified major foundational digital infrastructure (FDI) services by both service type and threshold. A cloud or co-location data centre facility service would fall within the proposed schedule when the data centre has critical IT load (CIL) of at least 10 megawatts (MW) and is used to serve parties unrelated to the operator. A cloud-computing service would qualify when it generates at least S$100 million per year on average over the preceding three years from users in Singapore and is an Infrastructure-as-a-Service (IaaS) or Platform-as-a-Service (PaaS) service; Software-as-a-Service (SaaS) is excluded from that stated category. These are proposed scope thresholds, not a claim that every data centre or cloud provider currently requires the new licence (MDDI and IMDA, 1 July 2026).

Proposed major FDI service licence

Providers within the proposed major-FDI-service scope would apply to IMDA for a major FDI licence. The consultation describes proposed duties covering physical and cybersecurity measures, business-continuity and disaster-recovery plans, timely resumption after interruptions, and notification to IMDA of cybersecurity incidents or service-delivery disruptions. Detailed practices would be set later through instruments such as regulations and codes of practice, so the consultation document should not be read as a complete operational compliance manual or as proof that the licensing regime has already commenced (MDDI and IMDA, 1 July 2026).

Proposed data-centre licence and sustainability requirements

Separately, the draft would require data-centre operators with CIL of at least 3 MW to apply for a DC licence. IMDA's proposed assessment would consider an operator's experience and capability, energy efficiency and water efficiency, and potentially energy-source characteristics and the strategic or economic importance of the operation. Licensed operators would meet facility-level power-usage-effectiveness requirements, with the Bill also enabling future requirements for IT-equipment energy efficiency and facility-level water efficiency. A data-centre operator providing a major DC Facility Service could need both licences, with the application process streamlined operationally (MDDI and IMDA, 1 July 2026).

Consultation status and proposed administration

The consultation closed on 22 July 2026 at 10am, after a three-week feedback window. If enacted, IMDA would administer the Act, with proposed powers to grant, renew, suspend or revoke licences, issue codes of practice and directions, impose financial penalties, and conduct enforcement and investigations. The proposal also includes related amendments to the Cybersecurity Act 2018 and the Cybersecurity (Amendment) Act 2024 to align definitions of foundational digital infrastructure service and data-centre facility service. These powers and amendments remain proposal-stage content unless and until the legislation is enacted, commenced and supplemented by final instruments (MDDI and IMDA, 1 July 2026).