Fire Safety and DOSH Compliance for a Kenyan Data Centre

Data centre fire safety in Kenya is governed by the same Occupational Safety and Health Act, 2007 (OSHA) that applies to any workplace, with no separate regime for server halls. The Act requires you to register the workplace, carry out and report risk assessments, commission an audit at least every twelve months, keep escape routes and fire-fighting means in order, and design and test evacuation procedures. A data centre concentrates the risks this law is written for: continuous high electrical loads, dense cabling, backup fuel storage, and a server hall that people cannot treat like an ordinary office floor. This article sets out what the statute requires and where operators commonly leave gaps.

Registering the workplace is the first, easily missed step

Section 44(1) of OSHA requires that before any person occupies or uses premises as a workplace, they apply to the Director of Occupational Safety and Health Services for registration, with the particulars in the Fourth Schedule. The Director must satisfy himself that the premises are suitable and then issues a certificate of registration (section 44(2)). The Cabinet Secretary may by Gazette notice except some classes of workplaces (section 45), so check whether any exception applies to your facility before assuming you are outside the rule.

Occupying or using premises as a workplace without a certificate is an offence carrying a fine of up to KES 100,000, imprisonment for up to three months, or both (section 44(5)). A data centre that has operated for years without a certificate is not unusual, and the gap undermines everything built on it, since inspection and enforcement start from a registered workplace.

Risk assessments and the annual audit

Under section 6(3) of OSHA, every occupier must carry out appropriate risk assessments in relation to the safety and health of persons employed and adopt preventive measures on the basis of the results. Section 6(4) requires the occupier to send a copy of the risk assessment report to the area occupational safety and health officer. For this kind of facility the assessment should name the real hazards: battery rooms, fuel storage, high-voltage switchgear, and work in enclosed server halls.

Section 11 requires the occupier to have a thorough safety and health audit carried out at least once in every twelve months by a safety and health advisor, with a copy of the report sent to the Director and the report kept available for inspection. Failure to comply is an offence liable to a fine of up to KES 500,000, imprisonment for up to six months, or both (section 11(3)). A documented annual audit is therefore the backbone of data centre fire safety compliance, and it should be diarised rather than left to chance.

What OSHA requires on fire prevention and escape

Section 78(1) requires stocks of highly inflammable substances to be kept in a fire-resisting store or in a safe place outside any occupied building, and not so situated as to endanger the means of escape. That provision bears directly on backup diesel and battery storage, areas that are easy to treat as an engineering matter alone.

Section 81 requires, in every workplace, adequate and suitable means for extinguishing fire that are conspicuously displayed and free from obstruction, persons trained in using them during all working hours, adequate means of escape, and escape routes kept maintained and free from obstruction. Doors that serve as exits must, except sliding doors, open outwards, and the contents of rooms must be arranged to leave a free passageway to an exit. In a server hall packed with racks, the passageway rule is where audits most often find a problem.

The Act is supplemented by subsidiary rules on fire risk reduction. We could not locate the text of those rules on Kenya Law, so we do not set out their specific requirements here. Confirm the current rules with the Directorate and your adviser before you rely on any particular drill frequency or labelling requirement.

Evacuation planning for a server hall

Section 82 requires every occupier to design evacuation procedures for use in any emergency and to have them tested at regular intervals. The occupier must stop operations where there is imminent and serious danger and evacuate persons, provide measures for emergencies and accidents including first aid, and take effective steps to ensure that all persons employed are familiar with the means of escape and the routine to follow in a fire or other emergency.

Data centre fire safety planning must reflect how the building actually works. Staff often work alone in a server hall on rotating shifts, and a gas-based suppression system, where installed, is itself a hazard that requires people to leave before it discharges. A generic plan copied from an office template will not answer that. Record each test of the plan, because a record of tests actually carried out is your evidence of compliance.

Fire suppression design and building approvals

A server hall’s suppression system is commonly a gas-based clean-agent design rather than water sprinklers, to protect live equipment. Its design and installation should not be treated as a vendor decision alone. The National Building Code, 2024 was published as Legal Notice 47 of 2024 under the National Construction Authority Act. The online version is a scanned document, so we could not review its fire-protection provisions in text form. Confirm with your architect and the relevant county authorities which approvals apply to your suppression system, and obtain them in writing. Approval requirements and OSHA duties sit side by side, not one in place of the other.

Treating suppression design purely as an engineering decision tends to cause trouble at the worst time, during an actual incident or an insurance claim afterwards. Our article on insurance for a Kenyan data centre operator explains why insurers will ask for these records.

What good data centre fire safety looks like

A defensible position covers five things: a current workplace registration certificate; risk assessments on file and reported to the area officer; a documented annual audit; escape routes, extinguishing means and flammable storage that meet sections 78 and 81; and an evacuation plan under section 82 written for your building and shift pattern, with records of tests. None of this is unusual for a commercial building of this scale, but a data centre makes the consequences of a gap larger.