Cybersecurity law & regulation in Singapore (2026)

Legal framework

Cybersecurity Act 2018 (amended by the Cybersecurity (Amendment) Act 2024), administered by the Cyber Security Agency of Singapore (CSA); complemented by PDPA breach-notification rules (PDPC) and sectoral regimes such as MAS Technology Risk Management requirements.

Key points: cybersecurity in Singapore

1. 01Comprehensive CII framework

   The Cybersecurity Act 2018 is the primary statute, empowering the CSA Commissioner to designate and regulate Critical Information Infrastructure across sectors including Energy, Water, Banking & Finance, Healthcare, Transport, Infocomm, Media, Security & Emergency Services, and Government.

   csa.gov.sg

2. 022024 Amendment Act in force

   The Cybersecurity (Amendment) Act 2024 was passed in May 2024 to address evolving risks; a tranche of its provisions commenced on 31 October 2025, updating CII rules and introducing 'Systems of Temporary Cybersecurity Concern' (STCCs).

   csa.gov.sg

3. 03Expanded CII incident reporting (2-hour rule)

   CII owners must report prescribed cybersecurity incidents to CSA within two hours of becoming aware; the 2024 amendments extended this to incidents reasonably suspected to involve Advanced Persistent Threats (APTs) and disruptions to essential services, including in non-interconnected systems under the owner's control.

   csa.gov.sg csa.gov.sg

4. 04New regulated entity categories (not yet commenced)

   The amendments also create future categories, Entities of Special Cybersecurity Interest (Part 3C) and major Foundational Digital Infrastructure providers (Part 3D), which were not part of the 31 October 2025 commencement and await later operationalisation.

   csa.gov.sg

5. 05PDPA mandatory data-breach notification

   Under the Personal Data Protection Act and the 2021 Notification of Data Breaches Regulations, organisations must notify the PDPC of notifiable breaches (those likely to cause significant harm or affecting 500+ individuals) as soon as practicable and within 3 calendar days of assessing the breach as notifiable.

   pdpc.gov.sg sso.agc.gov.sg

6. 06Sectoral overlay for financial institutions (MAS)

   The Monetary Authority of Singapore imposes stricter duties on financial institutions via its Technology Risk Management Notices/Guidelines, including notifying MAS within one hour of discovering a relevant/major incident and submitting a root-cause report within 14 days.

   mas.gov.sg mas.gov.sg

Timeline of decisions

1. 9 Feb 2026Incident · official
   Operation CYBER GUARDIAN: Multi-Agency Takedown of APT UNC3886 in Telecom Sector

   Singapore disclosed its largest-ever coordinated cyber incident response, spanning 11+ months, after state-sponsored APT group UNC3886 targeted all four major telecoms (M1, SIMBA, Singtel, StarHub); over 100 defenders from CSA, IMDA, CSIT, DIS, GovTech and ISD were mobilised. The operation demonstrated the activation of the whole-of-government response machinery now required under the amended Cybersecurity Act.

   Cyber Security Agency of Singapore

2. 31 Oct 2025Law · official
   Cybersecurity (Amendment) Act 2024: New Regulatory Classes Come Into Force

   The operational provisions of the 2024 Amendment Act commenced, introducing three new regulated entity classes: Foundational Digital Infrastructure (FDI, cloud providers and data centres), Entities of Special Cybersecurity Interest (ESCI), and Systems of Temporary Cybersecurity Concern (STCC). CII owners also gained new obligations for third-party and supply-chain incident reporting.

   Cyber Security Agency of Singapore

3. 4 Jul 2024Law · official
   Cybersecurity (Amendment) Act 2024 Gazetted

   The first major overhaul of the Cybersecurity Act since 2018, passed by Parliament on 7 May 2024 and gazetted on 4 July 2024, extended CSA's regulatory reach beyond traditional CII to cloud service providers, data centres, and other digital infrastructure; it also enabled virtual CII designations and tightened supply-chain cyber-risk accountability for CII owners.

   Singapore Statutes Online (Attorney-General's Chambers)

4. 4 Jul 2022Guidance · official
   Cybersecurity Code of Practice (CCoP) 2nd Edition Issued; Act Review Launched

   CSA issued the second edition of the CCoP for all 11 CII sectors, updating technical and governance baselines to address ransomware, 5G and cloud risks, while simultaneously announcing a formal review of the Cybersecurity Act itself, a review that culminated in the 2024 Amendment Act.

   Cyber Security Agency of Singapore

5. 1 Oct 2021Guidance · official
   Singapore Cybersecurity Strategy 2021 Released

   The refreshed national strategy replaced the 2016 edition, adding active cyber defence, whole-of-government CII protection, and international norm-setting as pillars; it explicitly recognised the shift to cloud and OT convergence and called for simplifying cybersecurity for end-users.

   Cyber Security Agency of Singapore

6. 1 Jan 2019Decision · official
   SingHealth COI Report and Ministerial Statement: Systemic Cyber Reforms Ordered

   The Committee of Inquiry published its findings on the 2018 SingHealth breach, concluding that a sophisticated state-sponsored APT exploited inadequate staff training, weak network segmentation and slow incident escalation; the Ministry of Health accepted all recommendations including Internet Surfing Separation, elevated CISO accountability and multi-line cyber-defence models that were later replicated across other CII sectors.

   Ministry of Health Singapore

7. 31 Aug 2018Law · official
   Cybersecurity Act 2018 Enters Force

   Singapore's first standalone cybersecurity statute established the Commissioner of Cybersecurity, a licensing regime for cybersecurity service providers, and mandatory CII owner obligations to report incidents, conduct audits and comply with directions, elevating cybersecurity from administrative policy to legally enforceable national obligation.

   Cyber Security Agency of Singapore

8. 31 Aug 2018Law · official
   Cybersecurity Act 2018 Commences

   Singapore's principal cybersecurity statute (No. 9 of 2018) entered force, establishing the first statutory framework for designating and protecting Critical Information Infrastructure across 11 sectors, empowering the Commissioner of Cybersecurity to investigate threats and incidents, licensing cybersecurity service providers, and codifying information-sharing between CSA and CII owners.

   Singapore Statutes Online (Attorney-General's Chambers)

9. 20 Jul 2018Incident · official
   SingHealth Data Breach Publicly Disclosed, 1.5 Million Records Stolen

   Singapore's largest data breach to that date was disclosed: a state-linked APT exfiltrated personal data of approximately 1.5 million patients and medication records of 160,000, including those of Prime Minister Lee Hsien Loong; the incident accelerated passage of the Cybersecurity Act and triggered a whole-of-government pause on new ICT systems pending a security review.

   Ministry of Health Singapore

10. 10 Oct 2016Guidance · official
    Singapore Cybersecurity Strategy 2016 Launched

    Prime Minister Lee Hsien Loong launched Singapore's first national cybersecurity strategy at the Singapore International Cyber Week, establishing four pillars: resilient CII, safe cyberspace, vibrant cybersecurity ecosystem and strong international partnerships, setting the policy direction that led directly to the Cybersecurity Act 2018.

    Cyber Security Agency of Singapore

11. 1 Apr 2015Decision · official
    Cyber Security Agency of Singapore (CSA) Established

    Singapore stood up CSA as a dedicated national cybersecurity authority under the Prime Minister's Office (later moved to the Ministry of Digital Development and Information), consolidating cybersecurity oversight, incident response, CII protection and international engagement functions previously fragmented across agencies, the institutional foundation of today's framework.

    Cyber Security Agency of Singapore

12. 30 Aug 1993Law · official
    Computer Misuse Act 1993 Enacted

    Singapore's foundational cybercrime statute criminalised unauthorised computer access, modification of computer material and interception of computer services. Repeatedly amended (including a 2017 expansion to cover cyber-attacks on critical infrastructure), it remains the primary instrument for prosecuting individual online offences and complements every subsequent online-safety law.

    Singapore Statutes Online

Sources

1. 1.csa.gov.sg/legislation/cybersecurity-act/
2. 2.csa.gov.sg/news-events/press-releases/provisions-in-the-cybersecurity--amendment
3. 3.csa.gov.sg/news-events/press-releases/csa-first-reading-of-the-cybersecurity-(am
4. 4.pdpc.gov.sg/report-data-breach/before-you-report-a-data-breach-3/info
5. 5.sso.agc.gov.sg/SL/PDPA2012-S64-2021
6. 6.mas.gov.sg/regulation/notices/notice-fsm-n05
7. 7.mas.gov.sg/regulation/guidelines/technology-risk-management-guidelines