Singapore wants the power to fine cloud giants and data centre operators up to a million dollars, or 10 percent of local revenue, if their systems go down. The island already knows what that looks like.
The Ministry of Digital Development and Information and the Infocomm Media Development Authority released the draft Digital Infrastructure Bill on July 1, and they're giving the public until July 22 at 10am to respond. That's a short runway for a bill that would put a licence, and a real financial penalty, on the companies that keep Singapore's internet running.
Under the draft, major data centre and cloud service operators face fines of up to S$1 million, or 10 percent of their annual turnover in Singapore, whichever is higher, according to Singapore Law Watch. The number sounds abstract until you see who it actually applies to. The bill defines a major foundational digital infrastructure provider as a data centre with a critical IT load of at least 10 megawatts that serves outside clients, the colocation and cloud facilities that host everyone else's servers, plus any cloud computing service pulling in S$100 million or more a year from Singapore users, averaged over three years, if it sells infrastructure or platform services rather than finished software. Amazon Web Services, Microsoft Azure and Google Cloud aren't named in the text. They don't need to be.
You don't have to squint to see why regulators moved now. On Sept. 10, 2024, a fire at a Digital Realty data centre in Loyang affected Alibaba Cloud's Singapore availability zone and services tied to tenants including Lazada and ByteDance. A year earlier, in October 2023, outages at DBS and Citi stopped about 2.5 million payment and ATM transactions from being completed in a single afternoon. Then came the cyber side of the same problem: Singapore said in July 2025 that UNC3886, a state-backed espionage group, had attacked critical information infrastructure, and reporting in February 2026 said all four major telecom operators, Singtel, StarHub, M1 and SIMBA, had been targeted. None of that is theory. It is what failure looks like when the pipes are digital.
Under the bill, IMDA would gain the power to grant, suspend and revoke licences, issue binding codes of practice, run investigations and levy penalties directly. Licensed operators would have to keep physical security and cybersecurity controls in place, maintain business continuity and disaster recovery plans, and report cybersecurity incidents and service disruptions to the authority as they happen, not after the damage has already become a customer service statement.
That last part is the one you should watch. Cloud customers usually learn about a bad outage from dashboards, vendor emails and scattered user complaints. Regulators get a cleaner view only when reporting rules force one into existence. If Singapore makes outage and breach disclosure a condition of keeping a licence, IMDA gets a record of how often these systems fail, how quickly operators respond, and which facilities keep turning up in the wrong column.
There's a second track in the same bill, and it points at a different constraint: electricity. Any data centre with a critical load of 3 megawatts or more, a far lower bar than the 10-megawatt threshold for the security licence, would need a sustainability licence. IMDA says it will weigh power usage effectiveness, water efficiency and the share of energy that comes from renewables when deciding whether to grant one. On a small, power-constrained island, data centres aren't just internet infrastructure. They're large industrial loads with political consequences.
Frankly, the headline fine isn't the sharpest part of this bill. S$1 million, a little over US$770,000, won't scare a cloud division that reports tens of billions of dollars in annual revenue. The 10 percent of local turnover clause is different. For a large enough operator, that could become real money quickly, especially if the licence also sits beside mandatory reporting, audits and binding operational codes.
The consultation closes on July 22 at 10am. After that, MDDI and IMDA will have to fold industry feedback into a bill that still has to clear Parliament. The cloud providers named nowhere in the text but sitting plainly inside its thresholds will be reading every line, because Singapore is treating uptime, cyber resilience and power use as licence conditions. That is the real change.
Also read: Sakana AI's Ren Ito Joins the UN's New AI for Good Commission, TikTok confirms layoffs in Singapore and three other cities in one day, Kioxia Sells Out Its Entire 2026 NAND Flash Supply Just as AI Chips Ship
