NFPA 75, NFPA 76 and building codes

A data center concentrates electrical power, heat, combustible plastics, batteries and very valuable equipment and information in one building. A fire can destroy hardware worth hundreds of millions of dollars, interrupt services that millions of people depend on, and endanger the staff and firefighters inside. Even a small fire that is quickly extinguished can cause a long outage if smoke, corrosive combustion products or suppression water damage the equipment, or if the power must be shut off. This course covers how data centers are protected: the codes and standards that apply, how fires are detected early, how they are suppressed, the particular hazards of lithium-ion batteries, and the physical security that protects the facility against people. This first lesson explains the regulatory framework and the basic building design features that limit fire spread, and the section at the end of the lesson shows how the twelve lessons fit together.

Why data center fires matter

Data center fires are rare, but when they happen the consequences are severe and public. Three examples illustrate the range:

• In March 2021, a fire at OVHcloud's campus in Strasbourg, France, destroyed one data center building and damaged another, taking millions of websites offline. Investigators linked its origin to electrical equipment associated with the power system, and the building's design (including a natural-ventilation structure that helped the fire spread, and the absence of an automatic suppression system) contributed to the loss. Some customers who had backups stored in the same campus lost data permanently.
• In October 2022, a fire that started in a lithium-ion battery room at the SK C&C data center in Pangyo, South Korea, cut power to servers used by Kakao, whose messaging, payment and taxi services were disrupted for days for millions of users.
• In September 2025, lithium-ion UPS batteries caught fire during maintenance work at South Korea's National Information Resources Service data center in Daejeon. All 384 batteries in the affected UPS were destroyed, the fire took about 22 hours to bring under control, and 96 of the government's 647 online services were disrupted, some for weeks.

Common lessons include the importance of separating batteries and electrical rooms from IT spaces, of automatic detection and suppression, of firefighter access and procedures for energized equipment, and of business continuity: copies of data and services in a different building or region, so that a single fire cannot cause a total loss (DCE-450).

The regulatory framework

In the US, construction is regulated by states and local jurisdictions, most of which adopt the International Building Code (IBC) and International Fire Code (IFC) from the International Code Council, with amendments; the edition in force varies by jurisdiction (2018, 2021 and 2024 editions are all in use). The IBC covers construction (occupancy classification, fire-resistance ratings, sprinklers, fire alarm, egress); the IFC covers operations, maintenance and hazards, including energy storage systems (IFC Section 1207). These codes reference NFPA standards such as NFPA 13 (sprinklers), NFPA 72 (fire alarm), NFPA 2001 (clean agents), NFPA 855 (energy storage) and NFPA 70 (the National Electrical Code).

Two NFPA standards are specific to IT facilities: NFPA 75 (Fire Protection of Information Technology Equipment), whose current edition is 2024, and NFPA 76 (Fire Protection of Telecommunications Facilities). NFPA 75 applies where referenced by the code (notably through NEC Article 645 for information technology equipment rooms that use its special wiring provisions) or where owners or insurers adopt it. Insurers also publish their own data sheets, such as FM Global's guidance for data centers, which can be more demanding than the codes.

The authority having jurisdiction (AHJ), usually the local building department and fire department, interprets and enforces the codes. For a large data center, early meetings with the AHJ to agree on the code approach, fire department access and any alternative solutions are an important part of design.

Occupancy classification

Building codes classify buildings by their use (occupancy), and the classification drives requirements for construction type, sprinklers, separations and egress. Data centers do not have a category of their own, so the designer and AHJ must agree on the best fit.

Under the IBC, data centers are commonly classified as Group B (business) or as Group S-1 or F-1 (moderate-hazard storage or factory), depending on the combustible content and the AHJ's interpretation. Ancillary spaces such as offices, loading docks, generator rooms and fuel storage may have different classifications and require separations between them, and energy storage rooms have their own requirements under the IFC.

Fire compartments and separations

Fire compartmentation divides a building into areas enclosed by walls and floors that resist the spread of fire for a specified time, called a fire-resistance rating, usually 1, 2 or 3 hours. In a data center, compartments are used to keep a fire in a battery room, electrical room or generator room from spreading into the data halls, to separate data halls from each other so that one fire affects only part of the capacity, and to protect exit stairs and corridors.

• Walls and floors: rated assemblies tested to standard fire exposure.
• Openings: doors and windows in fire-rated walls must have opening protectives with appropriate ratings (for example, a 3/4-hour door in a 1-hour fire partition or barrier and a 1-1/2-hour door in a 2-hour fire barrier), self-closing and latching.
• Penetrations: cables, pipes and ducts passing through rated assemblies must be sealed with listed firestop systems tested to ASTM E814 or UL 1479, and ducts need fire dampers. Data centers have enormous numbers of cable penetrations, and every added cable can breach a firestop if it is not resealed.

NFPA 75 calls for IT equipment areas to be separated from other occupancies by construction with at least a 1-hour fire-resistance rating, with exceptions, and battery and energy storage rooms often require 2-hour separation. Owners frequently exceed the minimum to protect business continuity.

Raised floors, ceilings and airflow

Data centers often use raised floors for cabling or cooling air and ceiling plenums for return air. These concealed spaces can let fire and smoke travel unseen, so codes and NFPA 75 address them: combustible materials and abandoned cables below raised floors are limited, cables in air-handling spaces must be rated for that use (plenum-rated cables with low flame spread and smoke), and detection may be required in the concealed spaces. High airflow from cooling units also affects how smoke moves and how quickly detectors respond, a subject covered in Lesson 3.

Combustible content in the IT space should be minimized: packaging must be removed in a staging area before equipment enters the data hall, paper and spare parts kept elsewhere, and abandoned cables removed. Each of these measures lowers the fuel load (the amount of combustible material in a space).

Power disconnection and the emergency power off

Firefighters are reluctant to apply water to energized electrical equipment, and some suppression strategies depend on removing power to stop a fire that is fed by an electrical fault. On the other hand, cutting power to a data hall causes an outage, which the operator wants to avoid unless it is truly necessary.

NEC Article 645 requires a disconnecting means (often an emergency power off button at the exit doors) for IT equipment and the dedicated HVAC in an information technology equipment room only where the designer uses the article's special wiring allowances; many large data centers are designed under the general NEC rules precisely to avoid a room EPO. NFPA 75 requires power to protected equipment to be disconnected before or on discharge of a total-flooding gaseous agent unless the risk assessment supports continuous power. Accidental EPO activation has caused many outages, so operators protect the buttons with covers, label them clearly and train staff.

Egress and firefighter access

People must be able to leave quickly, and firefighters must be able to reach a fire. Data centers pose particular challenges: large, maze-like halls with rows of racks and contained aisles, security doors and mantraps that restrict movement, high noise from cooling equipment, and clean agent systems that require evacuation before discharge. Codes limit the travel distance to an exit and require at least two exits from most spaces of significant size. Security doors on the egress path must release on fire alarm or loss of power, or have mechanical free egress from inside.

Fire departments need information that is specific to data centers: the location of battery rooms and their chemistry, electrical shutdown procedures, clean agent systems and their status, water supplies, and contacts who can explain the facility. Pre-incident planning with the local fire department, including site visits, is an important practice.

How this course is organized

The twelve lessons follow the layers of protection, from the building and the fire itself to people, operations and the integrated design:

• Lesson 1 (this lesson): building and fire codes, compartments, power disconnection and egress.
• Lesson 2: fire dynamics, fuels, smoke and fire risk assessment.
• Lesson 3: detection and early warning in high-airflow spaces.
• Lesson 4: fire alarm systems, notification and emergency planning.
• Lesson 5: sprinklers, pre-action systems and clean agents.
• Lesson 6: sprinkler hydraulics, water supplies and fire pumps.
• Lesson 7: lithium-ion battery fire hazards.
• Lesson 8: electrical fire risk, arc flash and life safety power.
• Lesson 9: physical security and access control.
• Lesson 10: security systems engineering and cyber-physical risk.
• Lesson 11: inspection, testing, maintenance and impairments.
• Lesson 12: performance-based design and a fire and security strategy project.