Singapore tightens security and sustainability rules for major data centres

Caption language: en · Fetched: 2026-10-09

Singapore's media and communications regulator IMDA is tightening regulations for major data center services and cloud providers. Voluntary standards will be replaced by mandatory baseline requirements. The goal is to prevent disruptions like the 2023 outage that affected banking payment and ATM services for more than 12 hours. Nadira Zidi has more. About twothirds of data centers in Singapore cross the 10 megawatt threshold for the new security and resilience requirements. These major data centers must be licensed by IMDA and have business continuity and disaster recovery plans. But MPs questioned whether individual recovery plans would be enough when different services can depend on the same infrastructure.

A provider may have a sound plan for its own systems yet still depend on a shared facility, power supply, connectivity pathway or overseas operational team. If that dependency fails, several independently sound plans may fail simultaneously. Banks, clinics, and government services can each comply and still depend on the same cloud provider, substation, cooling station, cooling system, or cable route. Engineers call this common mode failure. There is a shared point of failure. Senior Minister of State for Digital Development and Information Tankata says the government will look at operational resilience more broadly to identify common dependencies and patterns. >> The bill gives IMDA powers to set up business continuity, disaster recovery and incident reporting requirements.

The practices and measures for testing, assurance, and remediation are better developed through the codes of practice with industry and sector regulators. >> There are about 70 data centers in Singapore, all of which will come under the new sustainability requirements. Data centers with an IT power capacity of at least 3 megawatt will have to meet baseline energy efficiency requirements. water and IT equipment efficiency standards can also be introduced under the new framework. MPs also questioned whether growing electricity demand from data centers could eventually push costs onto households and smaller consumers. >> Large additional loads should not result in households and smaller consumers disproportionately bearing the cost of infrastructure built to serve these loads.

SMS says while managing costs is a challenge in many jurisdictions around the world the situation in Singapore is different. >> DCs do not buy electricity at the regulated household tariff. Like other large industrial consumers, they buy electricity from retailers at commercial rates or directly from the wholesale electricity market. They also pay for their own dedicated grid connections. The household tariff is driven mainly by fuel and electricity generation costs and the growth of DCS is not expected to raise this cost. >> Responding to questions on whether the rules will affect Singapore's competitiveness, SMS says the country does not compete on price but rather by being a trusted, connected and high value hub.