Proposed MDDI bill to strengthen security & sustainability of S'pore's data centres & cloud services

The Digital Infrastructure Bill had its first reading in Parliament on Sep. 8.

Introduced by the Ministry of Digital Development and Information (MDDI), it sets up two new licensing regimes to be administered by the Infocomm Media Development Authority (IMDA).

One covers the security and resilience of major data centres (DCs) and cloud services. The other covers the environmental sustainability of data centre operations.

Which operators are covered

The security and resilience regime applies to major co-location and cloud data centres with a critical IT load of at least 10 megawatts (MW). Data centres used solely for an operator's own internal purposes are not covered.

It also applies to major cloud service providers (CSPs) whose Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS) offerings generate at least S$100 million in average annual revenue from users in Singapore over the preceding three years.

MDDI said these thresholds were calibrated to cover the data centres and cloud service providers whose disruption would have a significant impact on Singapore's economy and society.

Licensees will have to implement security risk management measures and business continuity and disaster recovery plans, and report specified incidents and disruptions to IMDA.

It covers more than cyberattacks

MDDI said the Bill complements the Cybersecurity Act by covering a broader range of operational resilience risks.

These include technical failures, power or cooling issues, fires and other physical or operational incidents that can disrupt the delivery of digital services.

Energy efficiency requirements

Under the sustainability regime, all operators of data centres with a critical IT load of at least 3MW will be licensed.

As a first step, they will need to meet facility-level energy efficiency requirements, including Power Usage Effectiveness (PUE) requirements. These will apply to both existing and new data centres.

The framework also allows further requirements covering IT equipment and water efficiency to be introduced where necessary, following consultation with industry.

Commitments become licence conditions

The Bill also allows strategic, economic and green energy commitments, made in exchange for being awarded new data centre capacity, to be enforced as licence conditions.

MDDI said this ensures those commitments are accountable and create broader value for Singapore, given that capacity here depends on scarce national resources including land and power.

What industry said

MDDI and IMDA held a public consultation on the draft Bill from Jul. 1 to 22, receiving 25 responses.

MDDI said respondents supported the Bill's policy objectives and gave feedback on implementation, which has been taken into account.

It added that it will streamline licensing and reporting processes, recognise existing industry standards where possible, and give existing data centres sufficient transition time.

MDDI said:

"Altogether, the Bill will strengthen the foundations on which Singapore's digital economy, and our AI ambitions, will be built."