Mr Speaker, I rise to speak in support of this Bill.
Most Singaporeans have never been inside a data centre. But when we scan a payment QR code, access services via Singpass, or video-call a loved one overseas, we are relying on one. Data centres are the physical backbone of the modern digital world, powering our daily activities, essential services, and our economy. We tend to only notice them when something goes wrong.
And things do go wrong. In October 2023, technical issues with the cooling system at a data centre during a planned upgrade disrupted Singaporeans’ access to banking services. While the outage lasted less than 24 hours, its impact was significant. More than 2.5 million payment and ATM transactions could not be completed, and there were over 810,000 failed attempts to access digital banking platforms. In September 2024, it took SCDF two days to complete the damping down operations following a fire in a battery room at a Loyang data centre.
Neither incidents involved a cyberattack. It was the physical infrastructure that failed. We have a Cybersecurity Act that deals with actors who mean harm to our digital infrastrcuture. But it does not deal with a cooling system that malfunctions, a battery that catches fire, or a power supply that fails. It is thus timely to introduce legislation that addresses these non-cyber risks which also affect the security and resilience of major data centres and cloud service providers.
The Bill also takes an equally important step on sustainability, by placing the resource efficiency of data centres on a statutory footing. My colleagues have earlier set out what is at stake in that respect — our power, our water, our land, and the communities beyond our shores who absorb what we displace. I share those concerns, and I will not repeat them.
I would instead like to focus on asking: once we accept that these trade-offs have to be weighed, who weighs them, against what, and how would Singaporeans know? Almost every substantive requirement in this Bill will be prescribed later, in regulations and codes of practice. While this preserves flexibility and ensures that the requirements keep pace with technological developments, it also means that those details will not come before this House at subsequent readings of this Bill.
So even as I support the intent of the Bill, I would also appreciate the Minister’s clarifications about how it will work in practice. Now operators in this sector are not lightly regulated today. They already answer to BCA for the Green Mark, to PUB for water efficiency plans, to SCDF for fire safety, and to their own customers for a stack of international certifications. This Bill adds a new licence on top. My clarifications today are about how the Bill will add to, rather than compete with, what already exists.
First, on the licensing itself.
Will the application, audit, annual report and the renewal be designed as a single streamlined process, with one form and one set of supporting documents? And will information an operator has already given to IMDA under one limb be carried across, rather than requested again under another?
Second, and more substantially, on harmonising with what already exists.
Operators today already navigate a wide spread of credentials. Some carry legal force through the building regime. Some are national standards. Some are voluntary international frameworks to meet customer demands. I note that the draft Bill gives IMDA the tools to recognise these credentials:
- Clause 67(3) allows different provisions for different classes of operators.
- Clause 69 allows regulations to incorporate external standards by reference.
So I have four clarifications for the Minister:
- First, will the subsidiary legislation provide that holding a valid, accredited certification, such as a BCA-IMDA Green Mark Gold Plus or Platinum rating for Data Centres, or SS 564, creates a rebuttable presumption of compliance with the Clause 35 requirements?
- Second, will an audit report produced for an accredited framework, such as ISO 50001 or Green Mark, within the preceding twelve to twenty-four months be accepted toward the annual reporting and audit obligation under clause 36? An operator should not have to be audited on the same data twice in the same year for two different regulators.
- Third, will the Ministry use clause 67(3) to set a lighter reporting route for smaller and single-tenant facilities, reserving full third-party statutory audits for the larger ones, say those at ten megawatts and above? Hyperscalers easily absorb extra audit overheads; mid-tier local operators should not have to choose between paying for an audit and funding the physical equipment upgrades that the audit recommends.
- And fourth, will IMDA's verification protocols be aligned with existing accreditation bodies, such as SAC-accredited certification bodies, so that we are not building a parallel audit profession to check work that has already been checked?
Third, on non-cyber risks that are not regulated by IMDA alone.
Fire safety sits with SCDF under the Fire Safety Act. Building standards sit with BCA. Water efficiency sits with PUB. These agencies answer to different parent Ministries, and I am not suggesting that IMDA take over any of their functions.
This Bill gives IMDA a new instrument - license conditions. An operator will read the license conditions as the authoritative statement of what is expected of it. So I would be grateful if the Minister can confirm that these conditions – most of which will be laid out in subsidiary legislation – will be settled amongst the relevant agencies before they are issued, so that operators work to meet one set of coherent conditions rather than have to reconcile three or more sets of expectations.
I ask as there will be times where these requirements might pull against one another, and there should be clarity on how that will be resolved.
Let me illustrate this with the fire at the Loyang data centre in September 2024. The batteries involved were lithium-ion - the technology our green energy policy encourages data centres to adopt as it helps them store renewable power and ride through power outages. And when the fire started, the sprinklers did what they were designed to do: sprinkle water. Water spraying from the SCDF’s firefighting operations subsequently led to the server room experiencing water accumulation and leaks, resulting in heightened risk of electrical short circuits. This led to a decision for an emergency power shutdown, which further disrupted service provision.
I cite this example to illustrate how the measure that protects the building may not be the same as the measure which protects the service. While I am in no position to say which should yield to the other, if at all, an operator designing a battery room should get a single, clear, non-conflicting answer about what is expected.
Another example is what is written into Clause 25(2)(b) of the Bill, which requires IMDA to have regard to both energy efficiency and water efficiency. While next-generation liquid cooling promises to optimise both, legacy air-cooled facilities retrofitting their systems face real operational friction. Traditional evaporative cooling towers shed heat efficiently to save power, but consume heavy volumes of water. Dialling back water use without immediate capital upgrades can drive energy consumption up. The Bill names both statutory duties, but offers little clarity on how IMDA will weigh energy versus water metrics during licence evaluations for legacy facilities.
So I have three clarifications for the Minister:
- First, where requirements pull against one another, whether within the criteria set out in Clause 25, or with requirements of other agencies, what will guide IMDA’s decision in striking a balance? Can the Minister share an example of how such a tension would be resolved in practice?
- Second, will compliance with the new license conditions be taken as satisfying, or at least as aligned with, the baseline expectations of the consulting agencies, so that an operator which has met its license requirements is not later told by another agency that it has fallen short of something else?
- Third, will the codes of practice under Clauses 16 and 37 draw on the lessons of past incidents, including standards for lithium-ion battery storage safety, redundant cooling switchover, and physical isolation between plant rooms?
Mr Speaker, these are questions about implementation rather than intent of the Bill. No serious operator or service provider would object to being held to a standard. But what wears them down is being held to varying standards that have not been reconciled. Clarity is not a concession to business. It is the condition on which compliance happens.
I support the Bill.
