UK, Singapore and Vietnam rewrite critical infrastructure protection rules

Operators of data centres, cloud platforms and cable systems face new licensing, reporting and penalty exposure. The thresholds decide which companies are caught. Singapore's Act is expected to come into force in stages in 2027. Vietnam's text remains a draft, so the compliance bill is still unknown.

UK: 14 years and unlimited fines for cable damage

The white paper, published on 28 October, would replace the Submarine Telegraph Act 1885. It would also update the Telecommunications (Security) Act 2021 and the Communications Act 2003.

Intentional damage to undersea infrastructure could carry up to 14 years in prison. Reckless conduct would carry up to 10 years, and grossly negligent conduct up to two years. The government also proposes unlimited fines. Operators that refuse to comply with government orders could face fines of up to GBP 17 million or 10% of global turnover. Ministers would gain powers to order operators to remove or disable services during national security emergencies, and officials could access cable landing stations.

The government said it would generally publish those orders. It could keep them secret on national security grounds.

The UK has more than 64 active subsea cables landing on its shores, including 45 international systems and 19 domestic systems linking islands around the mainland. The government estimates those cables carry 99% of the UK's international data traffic.

In April 2026 the government accused Russian submarines of a covert operation around cables and pipelines in waters north of the UK. A parliamentary report published in 2025 examined the security of undersea infrastructure. The white paper also proposes requiring subsea telecommunications operators to identify and manage risks to their infrastructure.

Singapore licenses data centres and cloud providers

Singapore moved on a different track. Parliament passed the Digital Infrastructure Bill on 7 October 2026. The Ministry of Digital Development and Information and the Infocomm Media Development Authority (IMDA) had opened a public consultation. It began on 1 July 2026.

A major digital infrastructure licence covers commercial data centre facility services with a critical IT load of at least 10 megawatts. That covers facilities serving parties unrelated to the operator. The same licence reaches cloud providers with at least SG$100 million in average annual revenue from Singapore users over the preceding three years. That revenue must come through infrastructure as a service. It must also come through platform as a service.

A separate data centre licence starts at a critical IT load of at least 3 megawatts and adds environmental sustainability requirements. The two regimes operate independently. An operator above both thresholds needs both licences.

Singapore's digital economy accounted for 18.6% of GDP in 2024. The July 2024 CrowdStrike outage is cited as an example of how fast disruption can cascade across sectors. The bill aims to complement the Cybersecurity Act 2018. It does not aim to duplicate it. It covers operational and physical risks, not only cyber threats.

Vietnam rewrites a 2007 ordinance

Vietnam's rewrite reaches back further. The country has worked under Ordinance No. 32/2007/PL-UBTVQH11 for nearly two decades. The ordinance is dated 20 April 2007. A draft Law on the Protection of Important National Security-Related Structures would set criteria for classifying structures. It would also name the authority. That authority decides which sites go on the protection list.

The draft sets out the responsibilities of agencies, organisations and businesses, and coordination between protection forces. Its stated aim is a unified legal basis. That basis reduces overlaps between agencies. The draft uses Lam Dong province's Lien Khuong International Airport as a case for managing security through construction and reopening. Runway and taxiway repairs are planned there in 2026.

What happens next

IMDA has already published advisory guidelines for resilience and security of cloud services and data centres. Those guidelines indicate the controls likely to underpin licensing.