Roles, law and safety programs

A data center is a workplace like any other in the eyes of the law. The same occupational health and safety statutes that cover factories and offices apply to data halls and electrical rooms. What makes the legal picture more complicated is the number of parties involved. A single colocation building may have an owner, a separate operating company, dozens of customers with their own staff, a facilities management contractor, a security contractor, specialist maintenance vendors and a construction company building the next phase. Each has duties, and those duties overlap.

This lesson maps the parties, the laws and codes that apply in Canada and the United States, and the safety programs a data center should have. The facts are current as of 2026. Laws, codes and standards change, and each is adopted on its own schedule in each province, territory, state or city, so always check the edition in force where you work. Clause numbers are not given here unless they are well established; when you need a specific requirement, read the current document itself.

Because this course is offered in the United States, the US framework is described first, followed by Canada for comparison. Many data center operators run sites in both countries, and their corporate safety standards often blend US and Canadian references.

The parties and their roles

Start with who is who. The owner holds the land and building, sometimes through a real estate investment trust or an investment fund. The operator runs the facility day to day; in an owner-operated enterprise data center the two are the same company, while in colocation and some hyperscale arrangements they may be different. Customers or tenants place their equipment in the facility; in colocation they may send their own technicians to work in their cages. Contractors and vendors are hired by the operator, by a customer or by a general contractor to do specific work. Workers are the individuals actually doing the work, whatever company employs them.

These roles are not legal definitions. The law in each jurisdiction uses its own terms, and a company can hold more than one role. A facilities management company might be a contractor to the owner and at the same time the employer of every technician on site. What matters is that someone has clear authority to coordinate all the work at the site, and that every party knows what it must do.

United States

In the United States, the Occupational Safety and Health Act of 1970 covers most private employers. Federal OSHA enforces it directly in some states, and approved state plans, which must be at least as effective as the federal program, enforce it in others. The general industry standards in 29 CFR 1910 apply to data center operations and maintenance, while the construction standards in 29 CFR 1926 apply to construction work, including much of the work on a new hall or a major retrofit. Where no specific standard applies, OSHA can cite the General Duty Clause, section 5(a)(1) of the OSH Act, which requires employers to keep workplaces free of recognized hazards likely to cause death or serious physical harm.

Several OSHA standards in 29 CFR 1910 apply directly in data centers. Subpart S, Electrical, covers electrical installations and safety-related work practices, including training for workers exposed to electrical hazards and the rule that live parts are de-energized before work unless de-energizing creates greater hazards or is infeasible. The control of hazardous energy standard, 1910.147, covers lockout and tagout of equipment such as pumps, fans and mechanical plant. The occupational noise standard, 1910.95, sets a permissible exposure limit of 90 dBA over eight hours and requires a hearing conservation program at an action level of 85 dBA. The walking-working surfaces rules in Subpart D, the powered industrial trucks standard, 1910.178, and the emergency action plan rules in Subpart E also apply.

For electrical safety, OSHA's rules are supplemented by two NFPA documents. NFPA 70E, Standard for Electrical Safety in the Workplace, sets out the electrical safety program, risk assessment, approach boundaries, arc flash labels and personal protective equipment; OSHA does not adopt it as a regulation, but uses it as evidence of recognized hazards and feasible controls, and most data center operators follow it. The 2024 edition is current at the time of writing. NFPA 70, the National Electrical Code (NEC), is an installation code adopted by states and cities on their own schedules; the 2026 edition was published in 2025, but many jurisdictions still enforce an earlier one. NEC Article 645 contains special provisions for information technology equipment rooms.

Canada

In Canada, occupational health and safety is mainly provincial and territorial, with Part II of the Canada Labor Code covering federally regulated employers such as telecommunications carriers and banks. Workers have the rights to know, to participate and to refuse unsafe work. Provinces assign coordination duties at multiple-employer sites, such as the prime contractor in British Columbia and Alberta and the constructor on Ontario construction projects. CSA Z462, Workplace electrical safety, plays the role that NFPA 70E plays in the United States, and the Canadian Electrical Code, Part I (CSA C22.1), is the installation code adopted by each province and territory. Most provinces set an eight-hour noise limit of 85 dBA with a 3 dB exchange rate, which is stricter than the OSHA limit.

Fire protection standards for IT spaces

Two NFPA standards are written specifically for the kinds of spaces found in data centers. NFPA 75, Standard for the Fire Protection of Information Technology Equipment, covers the construction, fire protection and housekeeping of IT equipment areas. NFPA 76, Standard for the Fire Protection of Telecommunications Facilities, covers central offices, carrier hotels and similar spaces. The 2024 editions of both are current at the time of writing. They become mandatory when a code, regulation or authority having jurisdiction requires them, and many owners and insurers require them by contract even where no code does. Requirements in these standards about combustible storage in data halls, cable openings and emergency power off controls show up directly in site rules, which is why they are mentioned here. DCE-440 covers them from a designer's point of view, and HSE-323 covers the hazards of the suppression systems themselves.

Safety programs a data center should have

Laws and standards set the expectations; programs turn them into daily practice. A mature data center operator usually has a formal occupational health and safety management system, often aligned with ISO 45001, CSA Z1000 in Canada or ANSI/ASSP Z10 in the United States. Within that system, several programs matter especially in data centers.

The electrical safety program is required by both CSA Z462 and NFPA 70E. It defines who is qualified to do which electrical tasks, how risk is assessed, how electrically safe work conditions are established, when energized work is permitted and how it is approved, what personal protective equipment is used and how training and auditing are done. HSE-214, Electrical Safety Awareness, and HSE-224, Working On or Near Energized Electrical Systems, teach the general principles, and HSE-321 applies them to critical facilities.

The hazardous energy control program covers lockout of electrical and mechanical systems such as pumps, fans and cooling units. HSE-210 covers it in full. In data centers it is closely linked to change management, because isolating equipment is usually part of a planned change.

The change management program covers how work on live systems is requested, planned, reviewed, approved and carried out, including methods of procedure, maintenance windows and backout plans. Lesson 9 of this course covers it from a safety point of view, and ITIL-140 covers the IT service management side.

The contractor management program covers how contractors are prequalified, oriented, supervised and evaluated, and how permits to work are issued; Lesson 10 covers it. Other programs include hearing conservation (HSE-241), heat stress (HSE-243), material handling and lifting (HSE-218 and HSE-219), working at heights (HSE-212), emergency response (Lesson 11), and incident reporting and investigation.

import random

# Build a simple responsibility matrix for a planned task (illustrative)
random.seed(2)
parties = ["Owner", "Operator", "Customer", "Vendor", "Technician"]
duties = {
    "Site rules and orientation": "Operator",
    "Access badge and escort": "Operator",
    "Plan the rack installation": "Vendor",
    "Approve the change request": "Operator",
    "Confirm vendor competence": "Customer",
    "Supervise the technicians": "Vendor",
    "Follow procedures, report hazards": "Technician",
    "Provide a safe building": "Owner",
}
for duty, lead in duties.items():
    row = ["L" if p == lead else "." for p in parties]
    print(f"{duty:34s}", " ".join(row))
print("Columns:", ", ".join(parties))
print("Duties without a lead:", [d for d, p in duties.items() if p not in parties])

Site rules and orientation         . L . . .
Access badge and escort            . L . . .
Plan the rack installation         . . . L .
Approve the change request         . L . . .
Confirm vendor competence          . . L . .
Supervise the technicians          . . . L .
Follow procedures, report hazards  . . . . L
Provide a safe building            L . . . .
Columns: Owner, Operator, Customer, Vendor, Technician
Duties without a lead: []

A matrix like this is a quick way to check that every duty has a lead party before work starts. Duties that nobody owns are where incidents happen.