Новый законопроект Сингапура ужесточает требования к безопасности дата-центров, но не регулирует трансграничные данные

putilov_denis - stock.adobe.com Singapore’s digital infrastructure bill leaves cross-border data to contract Proposed licensing regime for datacentre and cloud providers tightens security and resilience obligations, but organisations using capacity in Johor and Batam will still rely on privacy law and contracts to protect data stored overseas Singapore’s draft Digital Infrastructure Bill sets out what providers of large datacentres and cloud services must do to keep their facilities secure and running, from physical security through to incident reporting. But it has nothing to say about the data itself once it leaves the country. The city-state froze new datacentre builds in 2019 over land, power and water constraints, and while the moratorium was lifted in 2022, capacity has been handed out in tranches ever since. Companies that could not get what they needed at home went to Johor, across the Causeway, and to Batam. Speaking to Computer Weekly ahead of the TechLaw.Fest conference next week, Rachel Yee, a board member of the Singapore Corporate Counsel Association (SCCA), the national body for in-house lawyers, said the bill is aimed at improving the resilience and security of digital infrastructure. “It puts in provisions to support business continuity, physical security, incident reporting – what keeps the infrastructure running,” Yee said, “but it doesn’t have specific provisions talking about how you protect confidentiality of information that’s been shared across borders.” Yee, who spent most of her career in energy and infrastructure and moved to the datacentre sector about a year ago, was speaking in her capacity as an SCCA board member rather than for her employer. She said the bill’s obligations are likely to be passed down the supply chain through contracts. “Operators would contractually try to layer that down to customers, and then customers would layer that down to their vendors,” she said. “So, it’s like a flow-through commitment on what you need to do for resilience and notification.” Personal data is treated differently. The Personal Data Protection Act does not stop it from leaving Singapore, said Yee, but the company that sends it abroad stays on the hook. “The obligation would remain on the company that is managing and has access to that data, to ensure that it has comparable protections wherever I send the data to,” she said. “When my data hits the other country, arguably I will also need to comply with that country’s regulatory regime. I would need to be prepared to comply with the overlapping regimes.” That is now routine work for in-house teams, she said, with compliance staff mapping out which country’s rules apply to which data as datacentre construction picks up in the Johor-Singapore Special Economic Zone and in Batam. To Yee’s knowledge, business information has no equivalent statutory protection. “Usually you see non-disclosure agreements, where we protect it using contractual support between companies. There’s also a common law action for breach of confidence,” she said. Some sectors, including finance and critical infrastructure, are also subject to additional rules. Yee pointed to her experience in power generation, where the Cybersecurity Act shapes how systems are built, and to the Monetary Authority of Singapore’s requirements governing financial institutions’ data protection and incident reporting obligations. The result is a layered regulatory regime. The Digital Infrastructure Bill addresses resilience and security, sector-specific requirements sit on top of it, and contracts cover much of what remains. “It requires multiple stakeholders to come together to ensure the protection of that data,” Yee said. Cloud and AI workloads add another complication, because technical requirements can change faster than the contracts that cover them. “The technical requirements are moving so quickly,” said Yee, adding that legal teams may bring in engineering colleagues to review technical specifications in construction contracts, for example. The bill also brings in energy efficiency requirements for datacentre operators, including those recently awarded new capacity. Digital Realty, Equinix, Keppel Data Centres and ST Telemedia Global Data Centres were provisionally allocated 50MW each last month under Singapore’s second datacentre call for application. The facilities will be built on Jurong Island under sustainability commitments that exceed the scheme’s minimum requirements. Yee’s advice to in-house teams is not to expect any of this to settle. “We need to be ready to be disrupted,” she said. “Regulatory requirements will continue to evolve. It will never stay in place in the digital infrastructure world.” Read more about IT governance in APAC - DBS has strung together as many as 80 agents to prepare credit approvals for big corporate clients but says the industry’s ability to police such systems is advancing at a fraction of the pace of the technology itself. - Snowflake’s chief data and AI officer talks up efforts to move access controls into the data layer, the cost of dynamic model routing and why governance cannot be baked into model weights. - Singapore Academy of Law’s Yeong Zee Kin, who helped shape Singapore’s model AI governance framework, sets out who answers when AI causes harm – and why the trail usually leads back to a human decision. - Most developers feel responsible for the AI tools they build, but few know the frameworks meant to keep patients safe, according to a study by Singapore’s Nanyang Technological University.