Data centre flood protection in Malaysia and Singapore
Floods rarely reach the data halls. They take out the systems a data centre cannot run without: the substation, generators, fuel tanks and pumps, chillers, cable entries, anything in a basement, and the roads that bring in staff and diesel. Protect those to a level well above the planning minimum, widely cited as the 500-year flood plus freeboard in FM Global guidance and the 1,000-year flood for essential facilities under ASCE 24-24, and back it with a written flood emergency response plan. In Singapore, PUB's drainage code also requires critical M&E equipment in critical infrastructure to sit at or above the minimum platform level.
Where flood actually hurts a data centre
A data centre is built to keep running when one component fails. Flood is dangerous because it can take out several supporting systems at once, usually from below and outside the white space.
- Substation and incoming power. If the grid connection or on-site substation floods, the site is on generators for as long as the water stays.
- Generators. Standby generators can be damaged and can float in a flood, which is why US guidance recommends raising them on platforms (Delaware I-ADAPT).
- Fuel tanks and pumps. FEMA warns that flooded fuel tanks can float, corrode, sever pipe connections and rupture, and that floating tanks are a fire and debris hazard (FEMA P-348). A dry generator with a flooded fuel pump is still a dead generator.
- Chillers and cooling plant. Flood can knock out cooling and utilities as well as site access, and long equipment lead times stretch the outage, as AXA XL noted in November 2026 (InsuranceAsia News).
- Cable and pipe penetrations. Good siting lowers the risk, but some flooding may still be possible, so the entry points for power, fibre and pipework need sealing (datacenter-forum.com).
- Basements. Anything below grade is the first thing to flood: switchgear, pumps, tanks, MDF rooms.
- Access roads and fuel delivery. A site can stay dry while the roads around it are under water. In October 2026 the road in Cyberjaya running from the data centre towards Cyber 10 was waterlogged after heavy rain (theSun).
- Internal water. Not every flood comes from outside. Cooling pipework, roof drainage and fire systems can put water where it does the most damage.
What happened at real sites
| Event | What failed | Source |
|---|---|---|
| Hurricane Sandy, New York, 2012 | At Peer 1, flooded basement fuel pumps cut diesel supply to generators on the 17th floor; staff carried fuel up the stairs by hand. At Datagram, both basement levels with diesel tanks, pumps and switchgear flooded, and power took about four days to restore. | Computerworld, DCK |
| Thailand floods, 2011 | Western Digital's Thai plant, which made about 60% of its drives, stopped. The first drive came off the line 46 days after the flood, and drive prices spiked worldwide. | IEEE Spectrum, The Register |
| Hurricane Harvey, Houston, 2017 | No major outages, but access roads to several sites flooded. Equinix pre-staged food, water and cots for staff. | DCK, Data Center Frontier |
| Malaysia, December 2021 | More than 100 Celcom network sites hit, mainly by power outages; high water and road conditions slowed access. No data centre building was reported flooded. | SoyaCincau |
| Google Cloud, Paris, 2023 | A cooling-system water pipe leak in a colocation facility led to water intrusion, an emergency shutdown and a battery room fire. Some rooms stayed offline for weeks. | Google Cloud status, The Register |
The pattern is consistent: fuel and power plant below grade, roads and logistics, and water from inside the building.
What an outage costs
In Uptime Institute's 2026 outage analysis, for the second year running, one in five respondents said their most recent impactful outage cost more than US$1 million (Uptime Institute). AXA XL makes the same point about flood and heat in Asia-Pacific: the resulting downtime and contractual costs can exceed the physical loss (InsuranceAsia News). That is why data centre flood insurance is mostly a business interruption question.
The standards, compared
Most data centre standards ask for a site risk analysis but give no flood number. The insurer and engineering standards are where the numbers sit.
| Standard | What it says about flood |
|---|---|
| ANSI/TIA-942 (older revisions) | An unofficial copy of an older tiering table puts Tier 4 at least 91 m from the 100-year flood hazard area and 0.8 km from waterways (anyflip copy). The revision is unknown. |
| TIA-942-C (May 2024) | Reported to replace simple flood-zone checks with formal risk analysis and mitigation at site selection (Cablinginstall). |
| EN 50600-2-1:2021 | Results of the environmental risk analysis "shall be considered during design"; flooding has its own clause (iTeh preview). |
| Uptime Operational Sustainability | Site location section covers natural disasters, including flood, and mitigation plans (Uptime standard copy). |
| FM Global DS 1-40 and DS 5-32 | As widely cited from unofficial copies: site above the 500-year flood with 0.3 to 0.6 m freeboard, and a written flood emergency response plan where the 500-year flood would reach the site (Scribd DS 1-40, DS 5-32 copy). The official text was not checked. |
| ANSI/FM Approvals 2510-2020 | Test and certification standard for flood barriers and other flood mitigation equipment; excludes coastal barriers (FM Approvals). |
| ASCE 24-14 | Flood Design Class 4 (essential) facilities to the higher of base flood plus 2 ft or the 500-year flood; includes fuel tanks needed to keep them running (FEMA). |
| ASCE 24-24 | Class 4 moves to the 1,000-year flood; Class 3 and 4 buildings need electrical connections above the design level for temporary generators (FEMA). |
| FEMA P-348 (2nd ed., 2017) | Guidance on protecting electrical systems, generators, fuel systems and tanks from flood (LA County copy). |
No source we found classifies data centres as ASCE 24 Class 4 by default; that depends on occupancy and the adopting jurisdiction.
Design measures, layer by layer
1. Site and level. Choose land and set floor and plant levels against the 100-, 500- and 1,000-year flood, local flood history and future rainfall. This is the cheapest layer to get right and the hardest to fix later. A data centre flood risk assessment is where those numbers come from.
2. Critical plant above the flood. Keep switchgear, transformers, generators, fuel pumps and tanks, UPS and batteries above the design flood level, and out of basements. After Sandy, Datagram planned redundant fuel pumping on a mezzanine 65 ft above the street (DCK). Anchor tanks against flotation, and provide a raised connection point for temporary generators, as ASCE 24-24 now requires for higher classes.
3. Envelope and openings. Seal cable and pipe penetrations, fit backflow protection on drains, and protect loading docks and ramps. Where barriers are used, look for products certified to ANSI/FM 2510 and match them to the hazard. See commercial flood barriers.
4. Internal water. Leak detection, and keeping water-bearing systems away from battery and electrical rooms, address the Paris type of failure.
5. Access, fuel and people. Plan for flooded roads: fuel on site for the expected isolation, staff sheltering, and supplies staged before the storm. Write it into a flood emergency response plan with triggers and drills.
In Malaysia and Singapore, flooding is often short, intense rainfall overwhelming drains, plus coastal and tidal flooding on reclaimed land. Warning times can be short, so our view is that permanent measures should come before manually deployed barriers. That is an inference, not a quoted requirement.
Singapore: PUB's code and the new licence
PUB's Code of Practice on Surface Water Drainage (7th edition, December 2018, with amendments under Addendum No. 3, April 2025) is mandatory for new developments and redevelopments.
- Clause 2.1, minimum platform level. For industrial and commercial developments, the highest of 4.0 m above Singapore Height Datum on the south coast or 4.5 m on the north coast, 600 mm above the adjacent road or ground, 300 mm above modelled flood levels if the development is critical or key infrastructure, or any level PUB specifies.
- Clause 2.2, crest level. Entrances, exits and openings to basements need a crest at least 300 mm above the minimum platform level for industrial and commercial developments.
- Clause 2.5, critical M&E equipment in critical or key infrastructure must be at or above the minimum platform level. The code's examples include substations, transformers, standby generators, MDF rooms and server rooms. If that equipment is in a basement, every opening to the basement must meet the clause 2.2 crest levels. The code does not name data centres.
The code also tells owners to raise levels as high as possible before relying on flood barriers, and requires annual declarations for barriers after completion. More in our Singapore flood protection guide.
Separately, Singapore's Digital Infrastructure Bill passed on 7 October 2026. It creates a resilience and security licence for colocation and cloud data centres with at least 10 MW of critical IT load, covering operational resilience risks, business continuity and disaster recovery, and incident reporting to IMDA. Commencement had not been announced at the time of writing, and public summaries do not mention flood by name (Baker McKenzie). Flood is still a natural hazard any such risk assessment would need to address.
Malaysia: drainage approval, no national platform level
In Malaysia, compliance with JPS's stormwater manual, MSMA, is a prerequisite for approving development plans involving drainage (NST), and JPS is reviewing the manual in 2026 (The Vibes). We found no numeric national minimum platform level comparable to Singapore's. The design flood level is therefore something the developer and its engineers set, which is why the insurer standards above matter more. Johor's data centre approvals focus on water and power, not flood; see Johor data centre flood risk and Malaysia flood protection.
Related guides
Frequently asked questions
- What flood level should a data centre be designed to?
- There is no single legal answer. FM Global's data sheets are widely cited, from unofficial copies, as asking for a site above the 500-year flood with 0.3 to 0.6 m of freeboard. ASCE 24-24 sets the 1,000-year flood for essential facilities in Flood Design Class 4. In Singapore, PUB's minimum platform level is a floor, not a target.
- Does Singapore's PUB code name data centres?
- No. Clause 2.5 of PUB's Code of Practice on Surface Water Drainage requires critical M&E equipment in critical or key infrastructure to be at or above the minimum platform level. Server rooms and main distribution frame rooms are given as examples of critical M&E equipment, alongside substations, transformers and standby generators. Whether a data centre is critical infrastructure depends on its classification.
- What has caused data centre flood outages in the past?
- In New York after Hurricane Sandy in 2012, floodwater in basements disabled fuel pumps and switchgear at Peer 1 and Datagram. In Houston in 2017 the buildings stayed up but access roads flooded. In Paris in 2023 a cooling water leak led to water intrusion and a battery room fire that took a Google Cloud zone offline.
- Has a data centre in Malaysia or Singapore flooded?
- We have found no public report of a data centre building in either country being flooded. The December 2021 floods in Malaysia affected more than 100 Celcom network sites, mainly through power outages, and flooded roads slowed repairs.
- Does ANSI/FM 2510 cover coastal flood barriers?
- No. ANSI/FM Approvals 2510-2020 tests flood mitigation equipment for riverine, tidal or rainfall flooding and states that flood barriers for coastal applications are outside its scope. Check certification against the actual hazard at coastal and reclaimed sites.