Does Singapore have a data retention law for hosting providers?

Is there a law that makes Singapore hosts keep logs?

Not in the statutes read for this page. The Personal Data Protection Act 2012, the Criminal Procedure Code 2010 and the Cybersecurity Act 2018 set no period for keeping traffic or connection records.

The only keep-records rule found in the Cybersecurity Act is section 29. It binds licensed providers of cybersecurity services, such as penetration testers, to keep engagement records for at least 3 years. Renting servers is not one of those licensed services.

In Singapore, the default for personal data is deletion when the purpose ends, not storage just in case.

What does the PDPA say about how long data is kept?

Section 25 sets a cut-off. An organisation must stop retaining documents with personal data, or anonymise them, as soon as it is reasonable to assume two things:

• the purpose of collection is no longer served by keeping the data;
• keeping it is no longer necessary for legal or business purposes.

The law gives no number of days. Many search results on "PDPA retention period" answer that question: how long a company may keep customer records. That is the opposite of a duty to log.

Does the PDPA apply to a hosting provider?

Partly. A host processing data for a client is a "data intermediary" under section 2. With a written contract, section 4(2) limits its duties for that data.

It keeps the protection duty of section 24, the retention duty of section 25 and the duty to report breaches to its client. Section 4(3) puts the full set of obligations on the client, as if it processed the data itself.

A host is a full organisation under the act for its own customer records. The Hong Kong equivalent is on what Hong Kong's PDPO requires from hosting providers.

What must a Singapore host do after a data breach?

Report it up the chain. Section 26C(3) requires a data intermediary to notify its client "without undue delay". The client then assesses whether the breach is notifiable.

A breach is notifiable if it causes, or is likely to cause, significant harm, or is of significant scale (section 26B). Section 26D then gives the organisation 3 calendar days after its assessment to notify the Personal Data Protection Commission. Affected individuals must usually be told as well.

Hong Kong's ordinance has no matching duty.

How can Singapore police get data from a host?

Through orders that reach existing records:

• Section 20 of the Criminal Procedure Code: an officer of sergeant rank or above can order a person to produce a document. That includes copies of electronic records.
• Section 39: an officer investigating an arrestable offence can access and search a computer. The officer can order its operator to help with usernames and passwords.
• Section 39(2B): covers computers located outside Singapore, or whose location is unknown, under conditions such as the owner's consent.

These powers copy what exists. A production order cannot produce records that a host never created.

Which newer Singapore laws touch datacenters and cloud?

Three, none of them a logging law:

• Cybersecurity Act, Part 3D, in force since 31 October 2025. It applies to designated major providers of "foundational digital infrastructure" services, defined as services that promote availability, latency, throughput or security.
• Digital Infrastructure Bill, read a second time on 6 October 2026. The minister's speech describes IMDA licences for data centres of at least 10 MW and large cloud providers. It covers resilience and incident notification; it does not mention log retention.
• Online Safety (Relief and Accountability) Act 2025, partly in force since 29 June 2026. The new Commissioner can order takedowns and require platforms to identify users who caused online harm.

How does Singapore compare with Hong Kong for a server?

Singapore has more sellers and higher prices. In Copperstrait's survey of 33 hosts selling bare metal in Asia on 2 November 2026, 26 sell in Singapore, more than in any other Asian location. 6 of them sell a Singapore machine payable in crypto without ID, billed monthly and shown in stock.

For a server with at least 16 cores, 64 GB of memory and 1.9 TB of SSD or NVMe, the median at those hosts was $903.51 a month in Singapore, against $425.00 in Hong Kong.

Compare networks and law on Hong Kong or Singapore for hosting. The local offer is on renting a dedicated server in Singapore.

What does Copperstrait keep about a Singapore server?

Only what billing and running the server need. No logs: no connection or traffic records, no visitor or customer IP address, and no note of how you found the site beyond a referral code if your link had one. What we hold is what billing and running your server need: the account number, and an email if you add one; every top-up and order (amount, coin, network, transaction ID, date); and for each server its name, plan, term, city, system, SSH public key, IP addresses and dates, plus the temporary root password we set when no key was given, which is useless once you change it. The datacenter’s network equipment is not ours to control. Records leave our hands only on the order of a Panamanian court.

Copperstrait is operated by DomaineGoat LLC, incorporated in Panama and answerable to Panamanian law only. The datacenter in each city is bound by the law of the place it stands in. In Singapore, that means Singapore law governs the datacenter and its network.

Prices and terms are on how much a Copperstrait server costs. This page sums up published law and is not legal advice.