VPNs with servers in Singapore

With the Public Prosecutor’s authorisation, section 40 lets officers require technical assistance and access to decryption information; refusal carries up to three years’ imprisonment or a fine of S$10,000, or both.

The Cybersecurity Act 2018, amended in 2024, regulates providers of foundational digital infrastructure, such as cloud services and data centres: they must follow codes of practice and report prescribed incidents. None of these provisions sets a log-retention period. Whether a VPN operator falls within any of them is not established.

Under section 117 of the Gambling Control Act 2022, the gambling regulator may direct IMDA to order an internet access provider to take reasonable steps to disable access to an online location tied to unlawful gambling; non-compliance by the provider carries a fine of up to S$20,000 a day, capped at S$500,000 per offence.

The Online Criminal Harms Act 2023 lets designated officers direct online service providers to stop communication, disable content or restrict accounts, and lets the competent authority order internet access providers to block a location after non-compliance. A person can seek reconsideration within 30 days and then appeal to a reviewing tribunal led by a District Judge or Magistrate; neither step suspends the direction.

Under the Protection from Online Falsehoods and Manipulation Act 2019, any Minister may instruct the competent authority to issue a correction or stop-communication direction when it is in the public interest; the Act also provides targeted correction, disabling and account restriction directions. Offences cover making or altering a bot to communicate false statements of fact, and taking a benefit for a service used for that: up to three years and S$30,000 for an individual.

A person must first apply to the Minister and may then appeal to the High Court, with the direction in force meanwhile. In The Online Citizen v Attorney-General ([2021] SGCA 96, October 2021) the Court of Appeal upheld the Act’s constitutionality, ruled on the burden of proof, and partly allowed one appeal.

The Online Safety (Relief and Accountability) Act 2025, passed on 5 November 2025, set up a commission that began work on 29 June 2026. It can direct takedown, restrict a perpetrator’s account and require platforms to provide end-user identity details. Promoting enmity between racial groups is punishable by up to three years (Penal Code, section 298A).

Police production orders under section 20 name no court. The order of the rows is the security score, and a server’s location is not a recommendation.