Opening Speech by SMS Tan Kiat How for the Second Reading of the Digital infrastructure Bill

Introduction

1. Mr Deputy Speaker, on behalf of the Minister for Digital Development and Information, I move, "That the Bill be now read a Second time".

2. Sir, we are introducing the Digital Infrastructure Bill to put in place the foundations for the next phase of our digital economy and society, by ensuring that our digital infrastructure services are resilient, secure and environmentally sustainable, so that businesses and Singaporeans can continue to rely on it.

3. I will first explain why the Bill is needed, so that Members better understand how the Bill supports Singapore's long-term competitiveness and growth.

4. I will then explain the Bill's key features. Primarily, the Bill establishes two licensing regimes:

   • First, for the security and resilience of foundational digital infrastructure services, namely major data centres and cloud services;

   • And second, for the environmental sustainability of data centres.

5. Finally, I will cover the key administrative and enforcement provisions to support these regimes, as well as related amendments to the Cybersecurity Act.

Background

6. The latest Singapore Digital Economy Report shows that our digital economy contributed $144.1 billion, or 19.3% of our gross domestic product (GDP) in 2025.

7. This contribution goes beyond the Information and Communications sector. Around two-thirds of our digital economy comes from digitalisation in the rest of the economy, including important sectors such as finance, trade and manufacturing.

8. Think also about how much we depend on digital services, such as digital banking and payments, ride-hailing apps, e-commerce and many services that we transact with in our daily lives. We use them to carry out financial transactions, check health records and access Government services.

9. Some of these digital services serve essential needs and carry sensitive data.

Foundational digital infrastructure services

10. These digital services, in turn, rely on the underlying digital infrastructure they run on to store, process and move their data.

11. This includes data centres, which are secure facilities that house large numbers of servers and other computing equipment, and cloud services, which let businesses and organisations use computing power, storage and other digital resources at scale without having to own and operate all that equipment themselves.

12. Many different digital services often rely on the same data centre or cloud service provider. When it is disrupted, the impact is not confined to one digital service. Many services can be affected at once and the impact can ripple across our economy and society.

13. This is what makes this infrastructure important, and why its disruption can have systemic impact.

14. When such foundational infrastructure is disrupted, many activities we take for granted can come to a standstill.

    • For example, a March 2021 fire in a data centre in France disrupted millions of web services, including those of banks and government agencies;

    • In October 2023, a data centre cooling system issue in Singapore affected online banking and payment services provided by major banks for more than 12 hours, resulting in 2.5 million failed payment and automated teller machine (ATM) transactions;

    • And in September 2025, a battery fire occurred at South Korea's national government data centre and disrupted one of the government's cloud storage systems. Years of data was lost, and some of it could not be recovered.

15. These incidents had different causes. But they point to the risks we are concerned about – technical failures and misconfigurations, power and cooling issues, fires or other physical incidents, and cyberattacks.

16. Any one of these can disrupt the infrastructure that many businesses and organisations rely on.

17. Besides resilience, we also need to plan for the long-term growth of data centres as we use digital technologies more extensively.

18. For instance, demand for compute – the processing power needed to run digital services and artificial intelligence (AI) – is rising quickly, driven in large part by the demand for AI services.

19. But an expanding data centre footprint can further strain Singapore's limited resources, such as land, power and water.

20. This calls for long-term planning, disciplined growth and robust gatekeeping to ensure that this growth stays within what our resources can sustainably support.

21. At this point, it is useful to look at what is happening elsewhere in the world. The sharp rise in demand for compute, particularly from AI in the last few years, has made data centre development a much more contested and politicised issue in many countries. Governments are responding in different ways, reflecting their own resource constraints, market structures and planning systems. In some jurisdictions, however, governments are now having to respond after rapid data centre growth has already created pressures around electricity, water, land, local impacts and economic benefits.

22. We are seeing new planning and regulatory measures, project pauses and, in some cases, moratoriums, even where significant investments have already been proposed or committed. These developments underscore the value of working through difficult trade-offs early, before they become harder to resolve and begin to affect business confidence, jobs and the wider economy.

23. With your permission, Sir, may I ask the Clerks to distribute a handout [PDF, 237.93 KB] ↗ (opens in new tab) on recent developments around the world, including in our region, around data centres. Members can see that Singapore is amongst a small number of countries that had taken steps several years ago to manage and steward data centre growth.

24. Sir, Singapore has always sought to take a longer-term approach. We plan ahead and work through these trade-offs before they become acute, so that we can create as much room as possible for our digital economy and society, as well as for our AI ambitions, while staying within our resource and environmental constraints.

25. We have done this by working closely with the industry, progressively raising standards, testing new approaches and allocating scarce data centre capacity carefully to support our national and digital economy needs. In other words, our approach has been to anticipate pressures, work through the trade-offs early and make room for growth, rather than wait for a crisis to force our hand.

Building on existing efforts

26. The Digital Infrastructure Bill is the next important step in this effort. We are not starting from scratch. We have been working on these challenges for some time together with the industry, progressively raising standards and testing what works before moving to a statutory baseline.

    • For security and resilience, the Infocomm Media Development Authority (IMDA) developed the Advisory Guidelines for Cloud Services and Data Centres in consultation with industry, and released them in February 2025. The guidelines draw on international and industry best practices and standards. They also build on the Multi-Tier Cloud Security (MTCS) Singapore Standard introduced in 2013, which has been enhanced over the years.

    • For sustainability, we have worked with industry to develop standards, best practices and benchmarks, including tropical data centres, IT energy efficiency and liquid cooling over the years. We have managed data centre capacity growth carefully since 2019 to ensure new data centres adopt best-in-class sustainability practices, for example, under the Data Centre – Call for Application exercises. More recently, we set out our long-term plans in the Green Data Centre Roadmap released in May 2024.

Why a statutory baseline is needed

27. We are not starting from scratch. We are building on this foundation and the proposed Digital Infrastructure Act references those foundations. Over the years, these measures have raised standards and improved industry practice. But they are voluntary, and voluntary measures cannot ensure consistent outcomes across the sector.

    • For security and resilience, because a single disruption can affect so many services at once, it is not enough for most providers to meet high standards. All major providers need to meet a common baseline.

    • For sustainability, voluntary standards leave each operator to improve at its own pace. But to create headroom for the sector to grow, we need all our data centres, not only the new ones, to be resource efficient.

28. The Digital Infrastructure Bill changes this. It gives IMDA the statutory tools to play two important roles.

    • First, as a gatekeeper, IMDA can require the major digital infrastructure providers and commercial-scale data centres covered by the Act to be licensed and to meet a common baseline of standards.

    • Second, as the sector regulator and standards-setter, IMDA can progressively update those baseline requirements as risks, technology and industry practices evolve. A standard that is good enough today may not be good enough five or 10 years from now. Put simply: set a clear floor, make sure everyone covered by the regime meets it, and raise that floor over time when it is practical and necessary.

Policy considerations in designing the DIA

29. Sir, before I turn to the technical provisions, let me set out the considerations that guided the design of this framework.

30. First, proportionality. We should regulate where there is a clear policy need and calibrate the requirements to the risks and the nature of the infrastructure involved. The Bill therefore takes a targeted approach, focusing the strongest obligations on infrastructure where disruption would have systemic impact, while applying sustainability requirements more broadly across the commercial-scale data centre sector.

31. Second, we draw on global best practices and international standards but adapt them to Singapore's circumstances. We are a tropical, land-constrained city; our data centres are often designed differently from those in other markets, and the profile of users and workloads here is distinctive. A requirement that works well elsewhere may not be directly applicable to Singapore.

32. Third, we should not front-run technological developments. Cooling, energy-efficiency, power-management and low-carbon energy technologies are still evolving. If we lock in particular technologies or prescribe the most stringent requirements before they have matured, we may narrow our future options and create unnecessary transition costs for businesses. Our objective is not to be the most stringent on paper, but to set requirements that are effective, practical and sustainable over time. We should start with what is practical and meaningful today, rather than wait for every pathway to be fully developed, while preserving the flexibility to strengthen the standards as technologies mature and become more cost-effective.

33. Fourth, the Digital Infrastructure Bill must fit within the wider Government framework. It is not an all-purpose instrument for every issue associated with digital infrastructure. A new data centre is not only a digital-infrastructure decision; it also has implications for land, electricity, water and our wider resource system. These broader questions are managed through their respective national frameworks and the whole-of-Government planning process. The Digital Infrastructure Bill should complement those regimes, not duplicate them.

34. Finally, the framework must provide certainty while remaining capable of evolving. Businesses making multi-decade, multi-billion-dollar investments need clear expectations and reasonable transition periods. At the same time, the detailed requirements must be able to develop as technology, risks, energy pathways and industry practices change.

Investment and the cost of doing business

35. Some may be concerned that the Bill introduces additional regulation and costs and may lower Singapore's attractiveness to investors.

36. We are mindful of the business cost imposed by regulation. That is why we have consulted extensively on the Bill and will continue to do so as we develop the detailed requirements.

37. But the alternative to clear regulation is not necessarily less regulation. For long-term, heavy capital expenditure investments, businesses value assurance that rules will be reasonable, predictable, credible and consistently applied.

38. This Bill provides that certainty by setting out the regulatory framework clearly, while giving us the flexibility to calibrate the detailed requirements as circumstances evolve. This is how we seek to support investment and growth without waiting for emerging pressures to become crises.

39. Sir, I look forward to Members’ support for this approach and to their constructive views on how we can continue to strengthen this approach as we move forward.

Overview and Key Features of the Bill

40. Let me now turn to the Bill. Some of the terms are technical, so I will explain them in plain language as I go.

41. The Bill establishes the legislative framework to hold major digital infrastructure service providers to baseline security and resilience standards and data centre operators to baseline environmental sustainability standards.

42. The Bill sets the overall legal framework, and the detailed technical requirements will sit in subsidiary legislation and Codes of Practice – in other words, the regulations and operating rules under the proposed Act, which we will continue to develop in consultation with the industry.

43. This is a deliberate design: the framework should be stable, but the standards should not stand still. This lets the technical rules evolve as circumstances and technology change.

44. The Bill comprises nine Parts.

    • Parts 1 and 2 relate to preliminary matters and the administration of the proposed Act by IMDA, including key definitions and the scope of application of the proposed Act.

    • Part 3 establishes the framework for the licensing and regulation of major digital infrastructure service providers, including obligations relating to the security and resilience of these services.

    • Part 4 establishes the framework for the licensing and regulation of data centre operators, including obligations relating to the environmental sustainability of data centres.

    • Parts 5 and 6 provide for reconsideration and appeals against specified decisions, and the enforcement powers available to IMDA.

    • Parts 7, 8 and 9 contain miscellaneous provisions, related amendments to the Cybersecurity Act 2018, and the savings and transitional provisions.

Licensing Regime to Ensure Security and Resilience of Major Foundational Digital Infrastructure Services

45. Let me start with Part 3. We are targeting the underlying infrastructure whose disruption could affect many businesses and organisations at the same time.

46. We will start with two types of services.

    • The first is major data centre facility services. The regime will cover data centre facility services provided in a data centre with a critical IT load (CIL) of at least 10 megawatts. Put simply, CIL is the "rated size" of the data centre's computing power supply – the maximum electrical power it is designed to deliver to its servers and other IT and network telecommunications equipment it houses. To be clear, it is not the amount of electricity the data centre consumes at every moment. The regime covers both large co-location data centres that host equipment for customers, and Cloud Data Centres used by cloud providers to serve their customers.

    • The second is major regulated cloud computing services that generate at least $100 million in average annual revenue from users in Singapore over the preceding three years and provide either Infrastructure-as-a-Service (IaaS) or Platform-as-a-Service (PaaS).

      • Put simply, these are the underlying cloud infrastructure and platforms on which many digital services are built.

      • Think of it like a building. IaaS provides the basic structure, while PaaS provides the common systems and services running on top of it. Many different applications can depend on these same underlying layers.

    • We are regulating major IaaS and PaaS services because a serious disruption at these foundational layers can affect many businesses and digital services at the same time.

    • We are not covering Software-as-a-Service (SaaS), because these are generally finished applications used by customers rather than the common infrastructure underneath them.

47. We have set thresholds so that the statutory obligations apply only to the major providers whose disruption could affect a significant number of businesses and organisations. This reflects the proportionate and risk-based approach I described earlier.

48. Providers of these services will have to apply to IMDA for a major digital infrastructure licence, and licensees must take measures to ensure the security and resilience of their major digital infrastructure services. Broadly, they must:

    • Implement processes and measures to ensure the physical and cybersecurity of their services and minimise the likelihood of unexpected service disruptions;

    • Put in place business continuity and disaster recovery plans – plans to keep essential operations going and to restore services quickly when disruptions occur; and

    • Notify IMDA of the occurrence of prescribed cybersecurity incidents or service delivery disruptions.

49. The detailed technical rules will be set out in regulations and Codes of Practice under the proposed Act, as provided in clauses 15 and 16. In developing them, we will draw on the Advisory Guidelines I mentioned earlier, as well as relevant international and industry standards.

50. The Codes of Practice may also set different requirements for cloud data centres and co-location data centres. This is in response to industry feedback received during the public consultation that the two types of data centres operate differently.

Licensing Regime to Ensure Environmental Sustainability for DCs

51. Let me turn to Part 4. Part 4 of the Bill establishes a licensing regime for data centres in Singapore to ensure their environmental sustainability.

52. The licensing regime will apply to:

    • Operators of data centres in Singapore with a CIL of at least 3 megawatts, regardless of whether they serve third-party customers or are used by the operator for its own purposes. To give Members a sense of scale, 3 megawatts is roughly comparable to the power demand of a major suburban shopping mall. This covers the commercial-scale data centres we are concerned about, while excluding smaller server rooms.

    • It will therefore cover cloud data centres, co-location data centres and enterprise data centres – that is, data centres used mainly for a company's own internal systems – if they meet the threshold.

53. This regime will apply to both existing and new data centres.

    • New data centres are generally designed and built to higher energy-efficiency standards.

    • But a significant proportion of Singapore's data centre capacity is housed in existing facilities.

54. If we want the entire sector to be more sustainable, we need to improve the efficiency of those existing data centres too. We plan to do so progressively over time. The pacing must balance the need for renewal against business realities, like investment and depreciation cycles.

55. As with the security and resilience regime, the detailed technical rules will be set out in regulations and Codes of Practice under the proposed Act, as provided for in clauses 35 and 37. In developing them, we will draw on existing initiatives, such as the Green Data Centre Roadmap, the BCA-IMDA Green Mark for Data Centres, as well as international standards.

56. Clause 35 of the Bill sets out the duty to meet environmental sustainability requirements for licensed data centre operators. It provides for IMDA to prescribe requirements in three areas:

    • Facility-level energy efficiency;

    • IT equipment-level energy efficiency; and

    • Facility-level water efficiency.

57. We are putting in place the legal basis for all three areas now, but will take a staged approach in introducing requirements.

58. At the outset, licensed data centre operators will be required to meet facility-level energy-efficiency requirements, measured through Power Usage Effectiveness (PUE). Put simply, PUE tells us how much extra electricity a data centre uses on top of the power that goes directly to its servers and IT equipment, for example, for cooling and power systems. The closer the PUE is to 1, the less energy is being used for these supporting functions, and the more efficient the facility is.

59. We recognise that PUE is a useful starting point, but it does not capture every dimension of sustainability. Over time, as measurement approaches and technologies mature, we can consider how other indicators should complement PUE and other efficiency measures.

60. In the future, we may consider requirements for IT equipment-level energy efficiency and facility-level water efficiency. Each will require a different approach.

    • For IT equipment, data centre operators often do not own or manage the servers their customers install and have limited visibility over when these are refreshed. We will encourage operators to work with their customers to understand their equipment efficiency and refresh plans and will consult industry before introducing any requirements.

    • For water, data centres that use more than 60,000 cubic metres of water a year must already comply with PUB's mandatory water efficiency management practices, which apply to all large water users. PUB can also impose water efficiency requirements on new facilities or projects in prescribed industries, where the projected annual water use equals or exceeds a prescribed threshold, currently set at 60,000 cubic metres of water a year. The Bill allows us to set water efficiency requirements for both new and existing data centres, if these become necessary as the sector grows and cooling technologies change.

Transitioning existing DCs

61. These requirements will be more challenging to meet for existing data centres, which were designed and built for different technical and operating environments.

62. Data centre operators have told us that they support the policy objectives of the new regime, but have asked for sufficient transition time to meet the new requirements, especially where significant upgrades or rebuilding work is needed.

63. We understand these concerns. Data centres are long-term and capital-intensive investments. It is therefore our priority to ensure a smooth transition. We will continue to work with data centre operators and other affected stakeholders on the details, including implementation and transition timelines.

Strategic & Economic and green energy commitments

64. Beyond these baseline sustainability requirements, the Bill also allows IMDA to hold data centre operators to the commitments they make when securing scarce new data centre capacity, such as through the Data Centre – Call for Application and the Strategic Digital Infrastructure Scheme (SDIS).

65. These conditions apply where an operator made such commitments to secure data centre capacity.

66. Under these capacity allocation exercises, operators are assessed not only on how environmentally sustainable their data centres will be, but also on the wider value they bring to Singapore, for example, investment and business spending, good jobs and talent development, innovation, research and development, and partnerships with our local ecosystem.

67. The Bill refers to these as strategic and economic contributions. Where an operator has made such commitments as part of its application for scarce data centre capacity, clauses 25 and 27 allow IMDA to take them into account and make them conditions of the operator's licence. Put simply: if a commitment helped an operator secure scarce capacity, it should not remain merely a promise on paper.

68. In assessing strategic and economic contributions, clause 25(4) requires IMDA to have regard to the opinion of the Economic Development Board (EDB).

69. Where an operator is alleged to have breached a strategic and economic licence condition, clause 39(6) also requires IMDA to have regard to EDB's opinion before taking enforcement action.

70. These recognise the role of EDB in negotiating, monitoring and evaluating the fulfilment of these commitments. In practice, EDB will first work with operators to understand and resolve any lapses, before enforcement action is taken.

71. Operators awarded capacity under the second Data Centre – Call for Application and the SDIS have also committed to source a substantial share of their electricity from eligible low-carbon energy pathways.

    • The Bill allows these green energy commitments to be licence conditions too.

    • If a green energy project fails to deliver and the operator draws more electricity from other sources than it committed to, clause 39(3) allows IMDA to require the operator to make good the shortfall. This can include transferring eligible carbon credits – which are credits representing verified reductions or removals of emissions –  to offset the additional emissions, and where the other electricity source is cheaper, to pay an amount representing any cost savings derived from not meeting its commitment.

72. This reflects our approach of maximising value from the compute capacity we have in Singapore.

    • We recognise that we have to manage the growth of data centres carefully as they use scarce resources, such as land, power and water.

    • But this does not mean simply imposing an arbitrary cap on this growth as it may curtail the vibrancy of the economy and the opportunities that this would bring to enterprises and workers, and limit the future capabilities of digital services that Singaporeans rely on.

73. That is why we are not seeking to attract every megawatt of data centre capacity we can. Instead, we seek to maximise the value that data centres add to our economy and society. Scarce capacity should not simply be allocated; it should be put to productive use and deliver the value that was promised.

74. We need to grow our data centre sector responsibly and strategically to ensure that our scarce resources are used efficiently and that data centre investments continue to generate lasting value for Singapore over the longer term.

75. Sir, this Bill establishes the statutory framework to help us achieve that objective and provides the regulatory levers to support our broader approach to new data centre and compute capacity growth in Singapore. Taken together, these requirements and commitments will help ensure that our data centre sector continues to support the growth of our digital economy.

Key Administrative and Enforcement Provisions

76. Sir, let me now turn to the key administrative and enforcement provisions that support the two licensing regimes.

Investigation and enforcement powers

77. Part 6 of the Bill provides IMDA with the necessary investigation and enforcement powers. These include powers to obtain information and documents to assess compliance with the proposed Act or licence conditions, and to conduct investigations in relation to any offence under the proposed Act.

78. At the same time, we recognise that during administration or enforcement, operators may be required to provide IMDA with commercially sensitive or other confidential information.

79. The Bill therefore contains safeguards governing the disclosure of information.

    • Clause 60 provides for the preservation of secrecy in respect of information obtained in the administration or enforcement of the Act.

    • Broadly, persons to whom the secrecy obligation applies must not disclose information obtained in the performance of their functions or duties, except if necessary to carry out such functions or duties, or where it is lawfully required by a Court or lawfully required or allowed by legislation. IMDA may also disclose the information in any of the circumstances in clause 60(7).

Saving and Transitional provisions

80. Sir, the last part of the Bill is Part 9, which provides for the transition into the new licensing regimes.

81. Clause 71 provides for existing providers of major digital infrastructure services and operators of data centres that fall within the scope of the Bill to continue providing the service or operating the data centre for six months starting on the date of commencement of Parts 3 and 4 of the Act respectively.

    • If the provider or operator applies for a relevant licence within that six-month period, the person may continue providing the service or operating the data centre until IMDA decides on their licence application or the application is withdrawn.

    • I would like to clarify what this six-month period means. It is meant as a period for existing entities to apply for their licences.

    • It does not mean that all regulatory requirements must be met within six months. The timelines for meeting these requirements will be set out together with the detailed requirements, in consultation with the industry.

Emergency powers

82. Clause 18 gives the Minister for Digital Development and Information emergency powers.

83. Broadly, these can only be used when a threat to a major digital infrastructure service creates a serious and imminent threat to Singapore's national security, defence, foreign relations, economy, public health, public safety or public order.

    • In such cases, the Minister may need timely information and coordinated action beyond what the other regulatory measures provide for.

    • The Minister may therefore authorise or direct any person or organisation to take the measures needed to prevent, detect or counter the threats.

84. The Bill also includes safeguards.

85. Information obtained under these measures may only be used or disclosed for limited purposes, such as countering the threat, and misusing it is an offence. Legally privileged information is also protected from compulsory disclosure.

Enforcement approach

86. Sir, let me turn to enforcement and let me say a few words about how we approach it.

87. The Bill provides IMDA with a range of tools from directions and censure to financial penalties, and the suspension or revocation of licences. These allow IMDA to respond in proportion to the seriousness of each breach.

88. However, where non-compliance arises, IMDA's general approach in the first instance will be to work with licensees to understand the circumstances and, where appropriate, require them to take remedial steps. For major foundational services, we will also be mindful of continuity for users. The purpose of regulation is to fix the problem, not create a second problem for users.

89. Where enforcement action is necessary, IMDA will consider relevant facts and circumstances of each case in determining the appropriate response. These include the nature and seriousness of the contravention, its impact and the steps taken by the operator to rectify the breach.

90. The maximum financial penalty for most breaches under the Bill, of $1 million or 10% of the licensee's annual turnover in Singapore, whichever is higher. This is a maximum and is not an automatic penalty. IMDA will consider the same factors in determining an amount proportionate to the gravity of each case.

Reconsideration and appeal of Decisions

91. The Bill provides avenues for recourse against certain decisions made by IMDA.

92. Clauses 44 and 45 provide for a two-step process under which an aggrieved party may first apply to IMDA for a reconsideration of its decision and, if the party remains dissatisfied following reconsideration, subsequently appeal to the Minister.

93. This applies to key decisions, including those on licence grant or renewal, licence conditions, directions, financial penalties and the suspension or revocation of licences. An application for reconsideration must be made within 14 days of the initial decision, and an appeal to the Minister within 30 days of the decision on reconsideration.

94. This framework allows IMDA, as the sector regulator with the relevant technical expertise, the opportunity to reconsider its decision and address the issues raised by the affected party in the first instance.

95. It also facilitates the resolution of matters at the appropriate level where possible, while preserving an avenue of appeal to the Minister if the affected party remains dissatisfied following IMDA's reconsideration. The Minister may also establish an Appeals Advisory Panel to advise on an appeal.

Related Amendments to Cybersecurity Act

96. Finally, let me turn to the related amendments to the Cybersecurity Act.

97. Part 3D of the Cybersecurity Act remains the framework for addressing cybersecurity risks relating to major digital infrastructure services. This Bill complements it to cover non-cyber risks.

98. To ensure consistency between the two regulatory frameworks, Part 8 of the Bill makes related amendments to the Cybersecurity Act.

99. Clause 70 harmonises the definitions of "foundational digital infrastructure service" and "data centre facility service" in the Cybersecurity Act with those in this Bill.

100. This ensures that the Cybersecurity Act substantially uses the same concepts when referring to the same terms as the Digital Infrastructure Bill.

101. Clause 70 also inserts a new definition of "digital infrastructure service" in the Cybersecurity Act.

     • This is broadly aligned with the definition in the Digital Infrastructure Bill but is extended to include digital identity management services for the issuance and validation of certificates for authentication of websites, computer systems, application software or connected devices.

     • Doing so retains the policy space for the Cybersecurity Act to strengthen the cybersecurity of these services, which in turn underpin the security of many other digital services.

102. We recognise that major digital infrastructure service providers that are licensed under Part 3 of this Bill and designated under Part 3D of the Cybersecurity Act will be subject to requirements under both regimes.

103. To reduce the operational burden for these providers, the Ministry of Digital Development and Information (MDDI), Infocomm Media Development Authority (IMDA), and Cyber Security Agency of Singapore (CSA) are working closely together to harmonise overlapping requirements and streamline regulatory processes where appropriate.

104. The Bill also requires IMDA's Codes of Practice to be consistent with those issued under the Cybersecurity Act.

Conclusion

105. Sir, let me conclude in Mandarin, please.

106. 主席先生，大多数国人这辈子可能都不会走进数据中心，但我们的日常生活，却越来越离不开它。

107. 无论是使用社理会邻里购物券、登入Singpass、网上付款、预约看病，还是经营生意，背后都有稳定的云端服务和数据中心在支撑。这项法案要守护的，不只是我们的数码生活，更是新加坡未来经济发展的基础。

108. 新加坡一向来都未雨绸缪，不会等到问题演变成危机，才来补救。所以，我们趁早建立制度，让资讯通信媒体发展局把好关，先定下清晰的基本标准，再随着科技发展和风险变化，逐步提高标准。在资源有限的情况下，我们更要善用每一分资源。我们的目标，不是追求最多的算力，而是创造最大的价值。

109. This Bill is fundamentally about planning ahead. Most Singaporeans may never step into a data centre. But much of what we do every day depends on one. So, we should put the right rules in place before problems become crises.

110. The DIA gives IMDA the tools to be an effective gatekeeper and standards-setter: to set a clear baseline for security, resilience and sustainability; to make sure regulated operators meet that baseline; and to raise the bar over time as technology and risks change.

111. We start with standards that are practical and effective today and improve them as the pathways become clearer.

112. This is not regulation at the expense of competitiveness.

113. Reliable infrastructure, clear rules and good stewardship of scarce resources are part of what makes Singapore a trusted place to invest and do business.

114. Our ambition is not maximum compute. It is maximum value from compute – for Singapore, our businesses and our people. Not just for now, but well into the future.

115. Sir, I beg to move.