Singapore’s Proposed Digital Infrastructure Bill Signals Where APAC Regulation Is Heading

Singapore’s proposed Digital Infrastructure Bill would designate data centres and cloud providers as critical national infrastructure, placing them in the same regulatory category as power grids, water systems and healthcare providers.

The legislation carries potential fines of up to $1 million for cybersecurity and resilience failures, and is being read by industry observers as an indicator of where infrastructure regulation across the Asia Pacific region may be heading.

Takanori Nishiyama, Senior Vice President APAC and Country Manager, Japan at Keeper Security, described the bill as “a signal the region cannot afford to ignore”.

Regulation arrives as threats accelerate

The proposal comes as frontier AI models and quantum computing raise concerns that threat actors will exploit emerging technologies against public infrastructure.

“The bill arrives at a time when frontier AI is accelerating attacks against public infrastructure systems and advancements in quantum computing are compressing the window organisations have to prepare for harvest-now, decrypt-later attacks targeting long-lived data,” Nishiyama commented.

Harvest-now, decrypt-later attacks involve adversaries stealing encrypted data today with the expectation that future quantum computers will be able to break the encryption protecting it.

“Traditional perimeter defences were never designed for either,” he added.

Cloud security gaps remain the region’s weak point

Research conducted by Keeper Security in 2026 found that 46 per cent of APAC security leaders identified cloud security gaps, including misconfigurations and excessive permissions, as their organisation’s biggest security weakness.

That figure sits 12 points above the global average.

The same research found just 38 per cent of respondents reported privileged access management as fully deployed within their organisations.

According to Nishiyama, the distance between what regulators are demanding and what organisations have actually implemented is where trouble is most likely to emerge.

“That gap between regulatory ambition and operational reality is where the next wave of incidents is likely to originate,” he warned.

Compliance moving beyond paperwork

Nishiyama argued that compliance across the region is shifting from a documentation exercise to an operational discipline, and outlined the steps organisations should take to prepare.

“Organisations should start by mapping which systems and vendors actually engage with sensitive or long-lived data, enforce least-privilege access so a single compromised credential cannot move laterally across environments, and build continuous session visibility rather than relying on periodic audits,” he stated.

Least-privilege access limits each user and system to only the permissions required for their role, reducing the damage a single stolen credential can cause.

Continuous session visibility, by contrast with periodic audits, gives security teams an ongoing view of who is accessing critical systems and what they are doing once inside.

For data centre operators facing designation as critical national infrastructure, Nishiyama’s message was that resilience needs to be designed in from the outset rather than bolted on to satisfy auditors.

“Data centres, like any critical infrastructure, must be built to contain compromise, not simply to prevent it,” he concluded.

If the bill passes, Singapore would become one of the first jurisdictions in the region to formally extend critical infrastructure obligations to the digital layer, a move other APAC governments are expected to watch closely as AI-driven threats and quantum-era risks reshape the security landscape.

Last Updated on July 2, 2026 by Nick Ross