Singapore turns up heat on data centres

Providers could lose their licence for failing to meet resilience rules.

Singapore plans to impose regulatory requirements on major data centre and cloud infrastructure providers after a 2023 cooling failure disrupted more than 2.5 million payment and ATM transactions, bringing resilience and environmental standards under a dedicated regime.

“The bill would directly impose resilience requirements, including business continuity and disaster recovery measures, on major data centre and cloud infrastructure providers,” Jeremy Tan, global co-head of privacy and data practice and Singapore managing partner at Bird & Bird ATMD LLP, said in an emailed reply to questions.

The Ministry of Digital Development and Information and the Infocomm Media Development Authority (IMDA) sought public feedback on the Digital Infrastructure bill in July.

The measure complements the Cybersecurity Act and seeks to boost the security and resilience of digital infrastructure services whilst improving the environmental sustainability of data centre operations.

“It covers the physical and power security of these facilities,” Jean Nie Ho, a partner at Dentons Rodyk & Davidson LLP, said via Zoom. “It's basically wider than what was contemplated under the Cybersecurity Act, and the other thing that's important is the energy conservation piece.”

Takanori Nishiyama, senior vice-president of Asia-Pacific sales at Keeper Security, Inc., said the bill addresses areas not fully covered by the Cybersecurity Act, even after its 2024 updates.

The Cybersecurity Act focuses on malicious digital threats, whilst the bill addresses disruptions that could arise from physical, power, and other noncyber failures, he said.

Data centres are expected to consume a fifth of Singapore’s national grid this year, the International Data Center Authority said in a May report.

The bill will establish two licensing regimes. A major foundational digital infrastructure licence will cover providers whose disruption could cause widespread operational problems for businesses and organisations that depend on their services. A separate data centre licence will govern the energy and water efficiency of covered facilities.

Tan said the proposed regime would bring affected providers into a more direct regulatory relationship with IMDA.

“Exactly what ongoing compliance will involve remains to be seen, because the detailed requirements will largely be set out in implementing regulations and licence conditions that have not yet been published,” he said.

The bill also gives IMDA direct enforcement powers. Under existing rules, service disruptions expose providers to civil consequences under customer contracts, Tan said.

Noncompliance could result in a licence being suspended or revoked, potentially preventing a provider from continuing to offer its services, he added.

Financial penalties could reach $1m or 10% of a licensee’s annual turnover, whichever is higher.

Tan called this a significant change from the existing framework, which does not give a regulator equivalent direct enforcement powers over data centre operators and major cloud service providers.

Nishiyama said the penalty structure is an upgrade from older infocomm regulations that relied on fixed maximum fines. “A 10% turnover lever scales appropriately with hyperscale cloud providers,” he said.

Beyond financial penalties, Ho said companies should ensure that boards understand the requirements and are prepared to make decisions on compliance.

“They will need to make sure that the directors, the board, are appraised and kept aware and are able to make informed decisions to take into account these new requirements,” she said.

Companies that could fall within the bill’s scope should first determine which licensing regime applies, Ho said.

They should then assess energy supply, consider greener energy sources, examine carbon credit options, and begin tracking power and water use if they do not already do so.

The measures would give operators a baseline for assessing resource efficiency once the detailed requirements and licence conditions are issued, she added.