Building and fire codes for data centres

A data centre concentrates electrical power, heat, combustible plastics, batteries and very valuable equipment and information in one building. A fire can destroy hardware worth hundreds of millions of dollars, interrupt services that millions of people depend on, and endanger the staff and firefighters inside. Even a small fire that is quickly extinguished can cause a long outage if smoke, corrosive combustion products or suppression water damage the equipment, or if the power must be shut off. This course covers how data centres are protected: the codes and standards that apply, how fires are detected early, how they are suppressed, the particular hazards of lithium-ion batteries, and the physical security that protects the facility against people. This first lesson explains the regulatory framework and the basic building design features that limit fire spread, and the section at the end of the lesson shows how the twelve lessons fit together.

Why data centre fires matter

Data centre fires are rare, but when they happen the consequences are severe and public. Three examples illustrate the range:

• In March 2021, a fire at OVHcloud's campus in Strasbourg, France, destroyed one data centre building and damaged another, taking millions of websites offline. Investigators linked its origin to electrical equipment associated with the power system, and the building's design (including a natural-ventilation structure that helped the fire spread, and the absence of an automatic suppression system) contributed to the loss. Some customers who had backups stored in the same campus lost data permanently.
• In October 2022, a fire that started in a lithium-ion battery room at the SK C&C data centre in Pangyo, South Korea, cut power to servers used by Kakao, whose messaging, payment and taxi services were disrupted for days for millions of users.
• In September 2025, lithium-ion UPS batteries caught fire during maintenance work at South Korea's National Information Resources Service data centre in Daejeon. All 384 batteries in the affected UPS were destroyed, the fire took about 22 hours to bring under control, and 96 of the government's 647 online services were disrupted, some for weeks.

Common lessons include the importance of separating batteries and electrical rooms from IT spaces, of automatic detection and suppression, of firefighter access and procedures for energized equipment, and of business continuity: copies of data and services in a different building or region, so that a single fire cannot cause a total loss (DCE-450).

The regulatory framework

In Canada, construction is regulated by the provinces and territories, most of which adopt the National Building Code (NBC) and National Fire Code (NFC) with local amendments, or publish their own codes based on them (for example, the Ontario Building Code and the British Columbia Building Code). The 2025 editions of the national model codes were released in late December 2025, and provinces adopt new editions on their own schedules, so the edition in force varies by province. The NBC covers construction (occupancy classification, fire separations, sprinklers, fire alarm, egress); the NFC covers the operation and maintenance of fire protection systems and hazards such as storage and batteries. They reference standards from ULC Standards and CSA, such as CAN/ULC-S524 (installation of fire alarm systems), CAN/ULC-S536 (inspection and testing of fire alarm systems), CAN/ULC-S1001 (integrated systems testing) and CAN/ULC-S115 (fire-stop systems), and NFPA standards such as NFPA 13 (sprinklers) and NFPA 2001 (clean agents).

Two NFPA standards specific to IT facilities are widely used in Canada as well, often because owners and insurers require them rather than because a code references them: NFPA 75 (Fire Protection of Information Technology Equipment) and NFPA 76 (Fire Protection of Telecommunications Facilities). Insurers also publish their own data sheets, such as FM Global's guidance for data centres, which can be more demanding than the codes.

The authority having jurisdiction (AHJ), usually the local building department and fire department, interprets and enforces the codes. For a large data centre, early meetings with the AHJ to agree on the code approach, fire department access and any alternative solutions are an important part of design.

Occupancy classification

Building codes classify buildings by their use (occupancy), and the classification drives requirements for construction type, sprinklers, separations and egress. Data centres do not have a category of their own, so the designer and AHJ must agree on the best fit.

Under the NBC, data centres are commonly classified as Group D (business and personal services) for office-like IT space, or as a Group F industrial occupancy, typically Group F, Division 2 (medium-hazard industrial) or Division 3 (low-hazard industrial), depending on the combustible content and the AHJ's interpretation. Ancillary spaces such as offices, loading docks, generator rooms and fuel storage may have different classifications and require separations between them.

Fire compartments and separations

Fire compartmentation divides a building into areas enclosed by walls and floors that resist the spread of fire for a specified time, called a fire-resistance rating, usually 1, 2 or 3 hours. In a data centre, compartments are used to keep a fire in a battery room, electrical room or generator room from spreading into the data halls, to separate data halls from each other so that one fire affects only part of the capacity, and to protect exit stairs and corridors.

• Walls and floors: rated assemblies tested to standard fire exposure.
• Openings: doors and windows in fire separations must have closures with appropriate ratings (for example, a 45-minute door in a 1-hour separation and a 1.5-hour door in a 2-hour separation), self-closing and latching.
• Penetrations: cables, pipes and ducts passing through rated assemblies must be sealed with fire-stop systems tested to CAN/ULC-S115, and ducts need fire dampers. Data centres have enormous numbers of cable penetrations, and every added cable can breach a fire-stop if it is not resealed.

NFPA 75 calls for IT equipment areas to be separated from other occupancies by construction with at least a 1-hour fire-resistance rating, with exceptions, and battery and energy storage rooms often require 2-hour separation. Owners frequently exceed the minimum to protect business continuity.

Raised floors, ceilings and airflow

Data centres often use raised floors for cabling or cooling air and ceiling plenums for return air. These concealed spaces can let fire and smoke travel unseen, so codes and NFPA 75 address them: combustible materials and abandoned cables below raised floors are limited, cables in air-handling spaces must be rated for that use (plenum-rated cables with low flame spread and smoke), and detection may be required in the concealed spaces. High airflow from cooling units also affects how smoke moves and how quickly detectors respond, a subject covered in Lesson 3.

Combustible content in the IT space should be minimized: packaging must be removed in a staging area before equipment enters the data hall, paper and spare parts kept elsewhere, and abandoned cables removed. Each of these measures lowers the fuel load (the amount of combustible material in a space).

Power disconnection and the emergency power off

Firefighters are reluctant to apply water to energized electrical equipment, and some suppression strategies depend on removing power to stop a fire that is fed by an electrical fault. On the other hand, cutting power to a data hall causes an outage, which the operator wants to avoid unless it is truly necessary.

Some codes and standards require a means to disconnect power to IT equipment and to shut down the HVAC serving the room, often through an emergency power off (EPO) button at the exit doors. Accidental EPO activation has caused many data centre outages, so operators protect the buttons with covers, label them clearly and train staff. In Canada, requirements depend on the provincial electrical code and the fire code approach agreed with the AHJ; where NFPA 75 is applied, it requires power to the protected equipment to be disconnected before or on discharge of a total-flooding gaseous agent unless the risk assessment supports continuous power.

Egress and firefighter access

People must be able to leave quickly, and firefighters must be able to reach a fire. Data centres pose particular challenges: large, maze-like halls with rows of racks and contained aisles, security doors and mantraps that restrict movement, high noise from cooling equipment, and clean agent systems that require evacuation before discharge. Codes limit the travel distance to an exit and require at least two exits from most spaces of significant size. Security doors on the egress path must release on fire alarm or loss of power, or have mechanical free egress from inside.

Fire departments need information that is specific to data centres: the location of battery rooms and their chemistry, electrical shutdown procedures, clean agent systems and their status, water supplies, and contacts who can explain the facility. Pre-incident planning with the local fire department, including site visits, is an important practice.

How this course is organized

The twelve lessons follow the layers of protection, from the building and the fire itself to people, operations and the integrated design:

• Lesson 1 (this lesson): building and fire codes, compartments, power disconnection and egress.
• Lesson 2: fire dynamics, fuels, smoke and fire risk assessment.
• Lesson 3: detection and early warning in high-airflow spaces.
• Lesson 4: fire alarm systems, notification and emergency planning.
• Lesson 5: sprinklers, pre-action systems and clean agents.
• Lesson 6: sprinkler hydraulics, water supplies and fire pumps.
• Lesson 7: lithium-ion battery fire hazards.
• Lesson 8: electrical fire risk, arc flash and life safety power.
• Lesson 9: physical security and access control.
• Lesson 10: security systems engineering and cyber-physical risk.
• Lesson 11: inspection, testing, maintenance and impairments.
• Lesson 12: performance-based design and a fire and security strategy project.