Building Safety Checklist 2026 - Q&A

Under the Fire Safety Order, the Responsible Person has a legal duty to take general fire precautions to ensure the safety of relevant persons, including implementing appropriate arrangements for evacuation. Importantly, primary legislation takes precedence over secondary legislation (such as regulations) and must be complied with as the overriding legal duty.

Where a resident in a private residential setting refuses to contribute to the cost of specific measures (for example, those arising from a PEEP or similar adjustment), the managing agent still has an overriding duty to ensure safety. In these circumstances, the managing agent should:

• Undertake and document a risk assessment, clearly identifying the risk to the individual and others.
• Explore reasonable adjustments in line with equality legislation, ensuring options are proportionate and justifiable.
• Seek alternative funding routes, recognising that costs for individual adjustments are unlikely to be recoverable through standard service charges unless they demonstrably benefit all residents.
• Implement interim risk control measures to reduce risk as far as reasonably practicable (e.g. management procedures, staff support, evacuation strategies).
• Engage with the resident to explain the risk and the legal obligations, keeping a clear audit trail of communication and decisions.
• Escalate where necessary, including seeking legal advice or involving the enforcing authority (Fire and Rescue Service), particularly where there is a significant life safety risk.

Ultimately, if a required measure is essential to life safety, the Responsible Person must act to implement it regardless of cost recovery challenges. Cost disputes are a separate matter and may need to be resolved through legal routes, but they do not remove the obligation to comply with fire safety legislation and ensure the resident’s safety.

Under the RPEEPs Regulations, there is no fixed statutory timeframe that dictates how long a person must have a disability before a PEEP is required. The requirement is risk-based, not time-based.

However, the key principle under the Fire Safety Order remains that the Responsible Person must ensure the safety of all relevant persons at all times, regardless of how long the risk exists. If a resident has a temporary or short-term disability that affects their ability to self-evacuate safely, then this must be addressed as soon as the risk is identified, regardless of how long the condition is expected to last.

To clarify, PEEPs are required wherever a person’s ability to evacuate is impaired, whether that impairment is permanent or temporary. This includes short-term conditions such as injury, illness, post-operative recovery, or pregnancy where mobility or cognition is affected. The expectation is that:

• A risk assessment is updated immediately once the change in circumstances is known.
• Appropriate measures (including a PEEP or interim arrangements) are put in place without delay.
• The arrangements are proportionate to the level and duration of risk, meaning short-term issues may be managed through temporary or simplified plans.
• The situation is reviewed regularly, with the PEEP removed or amended once the individual’s condition improves.

In the context of social housing, Awaab’s Law places clear expectations on landlords to act promptly where a hazard presents a serious and immediate risk to health or safety. Where such a risk is identified, make-safe action must be taken within 24 hours to make the situation safe, or suitable alternative accommodation provided if this cannot be achieved. This reinforces the need to respond immediately to changes in a resident’s circumstances, even where the condition is temporary.

This situation reflects the need to balance fire safety duties with data protection, emergency response needs, and safeguarding considerations. While residents may be willing to share personal information verbally, they can be reluctant to have sensitive details formally recorded, particularly within a Secure Information Box (SIB) that may be accessed in an emergency.

Under the Fire Safety Order, the Responsible Person must ensure that relevant information is available to support safe evacuation. However, this does not require excessive or intrusive personal detail—only information that is necessary and proportionate to manage the risk.

The Data (Use and Access) Act 2025 strengthens this position by introducing recognised legitimate interests, providing greater clarity and confidence for organisations to process and share personal data without consent where it is necessary for emergency response, safeguarding, and the protection of life.

In practical terms, this means that where information is required to support fire safety measures, evacuation planning, or to inform emergency services, it can be lawfully processed and shared without explicit resident consent, provided it is necessary, proportionate, and directly linked to managing risk. This is particularly relevant where failure to share information could place a resident or others at serious risk of harm.

In this context, the use of resident information to support fire safety and evacuation planning aligns clearly with these recognised legitimate interests, reinforcing that life safety and safeguarding considerations can take precedence over consent, provided data is handled appropriately and securely. See: https://www.gov.uk/guidance/data-use-and-access-act-2025-data-protection-and-privacy-changes#:~:text=Recognised%20Legitimate%20Interests,and%20other%20specified%20legitimate%20interests.

The latest edition of the Code of Practice for the Provision of Premises Information Boxes in Residential Buildings, published by the Fire Industry Association (FIA) in collaboration with the National Fire Chiefs Council (NFCC), reinforces this position. It emphasises that information held should be relevant, risk-based and proportionate, and that Responsible Persons should avoid including unnecessary personal or sensitive data. The guidance supports the principle of data minimisation, ensuring that only information that would assist operational response and firefighter decision-making is included. See: https://www.fia.uk.com/news/updated-secure-information-boxes-sib-s-code-of-practice-released-to-strengthen-building-safety-and-emergency-response.html

It is also important that any information placed within a SIB is appropriately controlled and, where possible, coded or anonymised, so that it does not clearly identify the location of all vulnerable residents if the box were accessed by unauthorised persons. This supports both data protection and safeguarding principles.

In practice, this means:

• Only recording the minimum information required to support safe evacuation (e.g. mobility impairment, need for assistance, presence of oxygen), rather than detailed medical histories.
• Avoiding unnecessary sensitive detail where it does not directly impact evacuation or fire risk.
• Using coding, symbols, or reference systems rather than explicit identifiers wherever possible.
• Clearly defining who can access the information and ensuring it is restricted to those involved in emergency response.
• Being clear that information may be shared with emergency services where necessary to protect life, even without explicit consent.
• Using clear, resident-friendly explanations about why the information is needed, how it will be used, and who may access it.
• Seeking informed consent where possible, and documenting where consent is declined.
• Considering alternative approaches where residents refuse written records, such as coded or summarised information, or management-based evacuation arrangements.
• Ensuring compliance with data protection principles, particularly data minimisation, purpose limitation, security, and safeguarding of vulnerable individuals.

It is also important to note that templates (including those from fire authorities such as LFB) are often designed to be comprehensive, but they are not prescriptive legal requirements and should be applied proportionately.

Ultimately, the priority is ensuring that, in an emergency, responders have sufficient information to act safely and effectively, while respecting individuals’ privacy and maintaining robust data handling and safeguarding standards.