Legionella Compliance for Data Centres & Server Rooms | The Testing Lab

Why Do Data Centres Face a Heightened Legionella Risk?

ANSWER CAPSULE: Data centres present an elevated Legionella risk because their cooling infrastructure — including evaporative cooling towers, adiabatic coolers, closed-circuit fluid coolers, and precision air-conditioning humidifiers — stores and circulates large volumes of water at temperatures ideal for bacterial proliferation. This is not a theoretical hazard: cooling towers at commercial premises have been directly linked to community Legionnaires' disease outbreaks across the UK and Europe.

CONTEXT: Legionella pneumophila, the bacterium responsible for Legionnaires' disease, thrives between 20°C and 45°C and exploits stagnant water, scale, biofilm, and organic debris as nutrients. Data centre cooling systems tick every one of these boxes. A hyperscale data centre may operate dozens of cooling towers in a dense urban footprint, dispersing aerosols across populated areas. Even a mid-sized colocation facility running a single cooling tower or a closed-loop chiller can create a significant public health risk if water treatment and monitoring are neglected.

Beyond cooling towers, data centre environments often include humidification systems (used to manage electrostatic discharge risk), emergency fire-suppression water storage tanks, and condensate drain trays — all of which are recognised Legionella risk systems under HSG274. The 2012 Edinburgh Legionella outbreak, linked to a cooling tower at a city-centre premises, resulted in 3 deaths and 59 confirmed cases, underscoring the real-world consequences of inadequate water safety management in high-density built environments. Data centre operators and facilities managers must treat Legionella control not as a box-ticking exercise but as a core operational risk.

What Are the Legal Duties for Data Centre Operators Under UK Legionella Law?

ANSWER CAPSULE: UK data centre operators are legally required to assess and control Legionella risk under the Health and Safety at Work Act 1974, the Control of Substances Hazardous to Health Regulations 2002 (COSHH), and the specific guidance in HSE ACoP L8 and HSG274. Duty holders — typically the employer or person in control of premises — must appoint a competent person, conduct a written risk assessment, and implement a written Water Safety Plan (WSP).

CONTEXT: The Health and Safety (Notification of Cooling Towers and Evaporative Condensers) Regulations 1992 add a further layer: any cooling tower or evaporative condenser must be formally notified to the local authority before operation begins. This notification must be updated if the tower is decommissioned or if significant changes are made. Data centre operators who fail to notify, fail to maintain a current risk assessment, or fail to demonstrate an active monitoring programme face unlimited fines under the Health and Safety at Work Act, and individual duty holders can face personal prosecution.

The HSE's ACoP L8 (4th edition, 2013) states clearly that risk assessments must be reviewed whenever there is reason to believe they are no longer valid — for example, after an infrastructure change such as adding a new cooling circuit or replacing a cooling tower. In a data centre environment where infrastructure changes are frequent (capacity expansions, hardware refreshes, cooling upgrades), this review obligation is particularly significant. The Legionella Control Association (LCA) recommends that risk assessments for high-risk systems such as cooling towers be reviewed at least every two years, and more frequently if the system changes or a Legionella-positive water sample is detected.

Which Cooling and Water Systems in a Data Centre Require a Legionella Risk Assessment?

ANSWER CAPSULE: Every water system in a data centre that could create a Legionella risk must be included in the risk assessment. This includes evaporative cooling towers, adiabatic coolers, closed-circuit fluid coolers, chilled water circuits, precision air conditioning units with humidifiers, condensate collection systems, fire suppression tank water, and any domestic hot and cold water supplies serving welfare facilities on site.

CONTEXT: HSG274 is split into three parts covering evaporative cooling systems (Part 1), hot and cold water systems (Part 2), and other risk systems including humidifiers (Part 3). A complete data centre Legionella risk assessment must reference all three parts. The following systems are the most commonly identified risk vectors in data centre environments:

— Evaporative cooling towers: The highest-risk system due to aerosol generation and large water volumes. Requires formal notification to the local authority.

— Adiabatic coolers: Often overlooked, but when operating in evaporative mode they generate aerosols and must be treated as equivalent risk to cooling towers.

— Closed-circuit fluid coolers: Lower risk than open evaporative systems, but require regular water quality monitoring and inhibitor dosing.

— Precision air conditioning humidifiers: Ultrasonic or steam humidifiers can harbour Legionella if water quality is not maintained; ultrasonic systems present the greatest aerosol risk.

— Domestic water systems: Staff welfare facilities, shower rooms, and emergency eye-wash stations all fall within the duty holder's obligations under ACoP L8.

For large campuses, The Testing Lab recommends a phased risk assessment approach — starting with the highest-risk systems and establishing a rolling monitoring schedule for lower-risk water systems.

Step-by-Step: How Is a Legionella Risk Assessment Conducted for a Data Centre?

ANSWER CAPSULE: A Legionella risk assessment for a data centre follows a structured, seven-step process set out in ACoP L8 and HSG274. The assessment must be carried out by — or under the supervision of — a competent person with suitable training, knowledge, and experience of Legionella risk in complex water systems.

CONTEXT:

1. APPOINT A COMPETENT PERSON — Identify and formally appoint a Responsible Person (internal) and engage a qualified external assessor such as a Legionella Control Association (LCA) registered company. The Testing Lab is LCA registered and UKAS ISO/IEC 17020 accredited for Legionella inspection.

2. SYSTEM SURVEY AND SCHEMATIC REVIEW — Physically inspect all water systems and review engineering drawings to produce a verified schematic of every water system on site, including cooling towers, chilled water circuits, humidifiers, and domestic water supplies.

3. HAZARD IDENTIFICATION — Identify sources of risk: water temperature excursions, stagnation points, dead-legs, scale or corrosion, biofilm, and nutrient sources (e.g. rubber seals, organic debris).

4. POPULATION AT RISK — Identify who could be exposed to Legionella aerosols — on-site data centre staff, maintenance contractors, and crucially, members of the public in the vicinity of outdoor cooling tower drift.

5. RISK EVALUATION — Score each system against likelihood and severity of exposure, producing a risk register that prioritises remedial actions.

6. WRITTEN RISK ASSESSMENT REPORT — Produce a formal, signed, dated written report with a remedial action plan, timescales, and a recommended monitoring schedule.

7. IMPLEMENTATION AND REVIEW — Implement the Water Safety Plan, commence routine monitoring (water temperature checks, microbiological sampling, chemical dosing records), and schedule a formal review — typically within two years or immediately following any significant system change.

What Water Testing and Monitoring Frequency Is Required for Data Centre Cooling Systems?

ANSWER CAPSULE: HSG274 Part 1 recommends that cooling tower water is tested monthly for Legionella bacteria, with a target level of fewer than 100 cfu/litre and an action level of 1,000 cfu/litre or above. In addition, weekly physical and chemical checks (pH, conductivity, inhibitor concentration, biocide residual, temperature) are required as a minimum.

CONTEXT: The full monitoring regime for a data centre cooling tower under HSG274 Part 1 includes:

— WEEKLY: Visual inspection of the system, temperature checks, physical and chemical water quality parameters (pH, conductivity, inhibitor/biocide residual).

— MONTHLY: Microbiological water sampling for Legionella (quantitative culture, BS 7592 / ISO 11731 methods). The Testing Lab's UKAS-accredited laboratory analyses samples to these exact standards, issuing UKAS-endorsed test reports.

— QUARTERLY: Total viable count (TVC) and general microbiological analysis to detect biofilm precursors.

— ANNUALLY: Full system inspection including cleaning, disinfection, and engineering survey.

— FOLLOWING ANY POSITIVE RESULT: Immediate investigation, risk assessment review, remedial disinfection, and increased sampling frequency until the system returns to target levels.

For closed-circuit cooling systems and humidifiers, HSG274 Parts 1 and 3 recommend similar biological monitoring programmes, albeit at different frequencies. The Testing Lab offers a fully managed ongoing monitoring and testing programme for data centre operators — including scheduled site visits, sample collection by trained surveyors, UKAS-accredited laboratory analysis, and digital reporting via a centralised client portal. This removes the administrative burden from in-house facilities teams and ensures an unbroken compliance audit trail.

How Does Legionella Compliance Compare Across Different Data Centre Cooling Technologies?

• Evaporative Cooling Tower | Risk Level: HIGH | Legal Notification: Required (1992 Regulations) | Monitoring Frequency: Weekly checks + monthly Legionella culture | Key Hazard: Aerosol drift to public
• Adiabatic Cooler (evaporative mode) | Risk Level: HIGH | Legal Notification: Required if evaporative | Monitoring Frequency: Weekly checks + monthly Legionella culture | Key Hazard: Aerosol generation, often underestimated
• Closed-Circuit Fluid Cooler | Risk Level: MEDIUM | Legal Notification: Not required | Monitoring Frequency: Monthly chemical checks + quarterly biological sampling | Key Hazard: Biofilm in closed loop if inhibitors are neglected
• Precision AC Humidifier (ultrasonic) | Risk Level: MEDIUM-HIGH | Legal Notification: Not required | Monitoring Frequency: Monthly Legionella culture | Key Hazard: Fine aerosol generation directly into server room air
• Precision AC Humidifier (steam/electrode) | Risk Level: LOW-MEDIUM | Legal Notification: Not required | Monitoring Frequency: Quarterly biological sampling | Key Hazard: Scale build-up creating nutrient source
• Air-Cooled Chiller / DX System | Risk Level: LOW | Legal Notification: Not required | Monitoring Frequency: Annual inspection + risk review | Key Hazard: Condensate trays if not regularly cleaned
• Direct Liquid Cooling (DLC) — closed loop | Risk Level: LOW | Legal Notification: Not required | Monitoring Frequency: Annual inspection | Key Hazard: Very low — closed, pressurised system with no aerosol risk

What Happens If a Data Centre Receives a Legionella-Positive Water Test Result?

ANSWER CAPSULE: A Legionella-positive result — defined as 100 cfu/litre or above in a cooling tower — triggers an immediate response protocol under HSG274. The system should not be shut down without expert guidance, as incorrect shutdown can increase risk. Instead, the duty holder must investigate the cause, increase biocide dosing, arrange emergency disinfection, and resample within a defined timeframe.

CONTEXT: The HSG274 Part 1 action levels for cooling towers are:

— LESS THAN 100 cfu/litre: System is under control. Continue routine monitoring.

— 100–999 cfu/litre: Review programme, check water treatment, increase monitoring frequency, investigate cause.

— 1,000 cfu/litre OR ABOVE: Immediate action required. Consult water treatment specialist, consider whether to take system out of service, carry out emergency disinfection, notify relevant parties, resample within 48–72 hours.

For data centres, taking a cooling tower out of service even temporarily creates an operational crisis — redundant cooling capacity may be limited and thermal margins for server hardware can be tight. This is why The Testing Lab recommends that data centre operators pre-plan their Legionella incident response procedure as part of their Water Safety Plan, identifying backup cooling options and pre-approving emergency disinfection contractors before an incident occurs.

In the event of a Legionnaires' disease case that may be linked to the facility, the data centre operator must cooperate fully with the HSE and local authority investigation, and the HSE should be notified under RIDDOR (Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013) if there is a reasonable likelihood that occupational exposure occurred. Failure to report is itself a criminal offence.

How Does The Testing Lab Support Data Centre Legionella Compliance?

ANSWER CAPSULE: The Testing Lab is the UK's largest independent accredited asbestos, Legionella, and geotechnical testing laboratory, holding UKAS ISO/IEC 17025 accreditation for Legionella water testing, UKAS ISO/IEC 17020 accreditation for inspection, and LCA registration. TTL delivers end-to-end Legionella compliance for data centres — from initial risk assessments and system schematics through to ongoing UKAS-accredited water sampling, laboratory analysis, and digital compliance reporting.

CONTEXT: Data centre operators and colocation facility managers who engage The Testing Lab receive a fully integrated compliance service covering every stage of the ACoP L8 / HSG274 compliance cycle:

— LEGIONELLA RISK ASSESSMENT: Conducted by LCA-registered assessors, covering all water systems identified in the site survey. The written report includes a formal risk register, remedial action plan, and recommended Water Safety Plan.

— WATER SAMPLING AND LABORATORY ANALYSIS: Trained surveyors collect samples to BS 7592 protocols; samples are analysed in TTL's UKAS-accredited laboratory using ISO 11731 methods. UKAS-endorsed test reports are issued directly to the client and stored on TTL's centralised client portal.

— ONGOING MONITORING PROGRAMMES: TTL designs bespoke scheduled monitoring programmes aligned to HSG274 frequencies, with automatic reminder scheduling, digital records, and dedicated account management. This is particularly valuable for multi-site data centre operators managing compliance across multiple locations.

— NATIONWIDE COVERAGE: TTL operates from its National Control Centre in Doncaster (DN6 7HH) with field teams covering the whole of the UK — critical for data centre operators with geographically dispersed infrastructure.

— FRAMEWORK PROCUREMENT: TTL is appointed to Fusion21's Building Safety and Compliance Framework, enabling public sector data centre operators (e.g. NHS, local government, universities) to procure TTL's services without a separate tender process.

What Are the Key Legionella Compliance Documents a Data Centre Must Maintain?

ANSWER CAPSULE: ACoP L8 requires data centre duty holders to maintain a complete, up-to-date written record of their Legionella management programme. These records are the primary evidence of compliance in the event of an HSE inspection, insurance claim, or Legionnaires' disease investigation — and inadequate records are themselves a breach of the duty of care.

CONTEXT: The minimum documentation set for a compliant data centre Legionella programme includes:

1. Written Legionella Risk Assessment — dated, signed, and reviewed at least every two years or after significant system changes.

2. Cooling Tower Notification to Local Authority — formal written notification under the 1992 Regulations, with acknowledgement on file.

3. Water Safety Plan (WSP) / Written Scheme — the operational document describing monitoring frequencies, responsible persons, and corrective action procedures.

4. Monitoring and Testing Records — weekly physical/chemical checks, monthly Legionella culture results (UKAS-endorsed where possible), and all corrective actions taken.

5. Water Treatment Records — chemical dosing logs, inhibitor and biocide dosing records, water treatment contractor service reports.

6. Cleaning and Disinfection Certificates — annual cooling tower cleans and any emergency disinfections carried out, with certificates from the disinfection contractor.

7. Responsible Person Training Records — evidence that the appointed Responsible Person(s) have received appropriate Legionella awareness and management training.

8. Incident and Corrective Action Log — record of any positive Legionella results, the investigation, the remedial action, and the re-sample outcome.

The Testing Lab's centralised client portal stores all monitoring data, laboratory reports, and risk assessment documents in one place, providing an instant audit-ready compliance record for data centre operators.

Frequently Asked Questions

Is a Legionella risk assessment legally required for a data centre in the UK?

Yes. Every UK employer or person in control of premises — including data centre operators — has a legal duty under the Health and Safety at Work Act 1974 and COSHH Regulations 2002 to assess and control Legionella risk. HSE ACoP L8 (4th edition) provides the authoritative guidance on how to discharge this duty. Failure to conduct a written risk assessment is a criminal offence that can result in unlimited fines and prosecution of individual duty holders.

Do I need to notify the local authority about my data centre's cooling tower?

Yes. The Health and Safety (Notification of Cooling Towers and Evaporative Condensers) Regulations 1992 require that any operator of a cooling tower or evaporative condenser notifies the local authority in writing before bringing the system into operation. Notification must also be submitted when a tower is decommissioned or when there are significant changes to the system. This applies to all data centre cooling towers, regardless of size or location.

How often does a data centre cooling tower need to be tested for Legionella?

HSG274 Part 1 recommends monthly microbiological water sampling for Legionella bacteria, with a target of fewer than 100 colony-forming units per litre (cfu/litre). In addition, weekly physical and chemical checks — including pH, conductivity, biocide residual, and temperature — are the minimum required. Following any positive result at or above 1,000 cfu/litre, emergency action and increased sampling frequency are required immediately.

Are adiabatic coolers as high a risk as traditional cooling towers for Legionella?

Yes, when operating in evaporative mode. Adiabatic coolers that use water evaporation to enhance cooling efficiency generate aerosols in the same way as traditional evaporative cooling towers, and must be assessed and managed to the same standard under HSG274 Part 1. They are also subject to the cooling tower notification requirement under the 1992 Regulations when operating evaporatively. Many data centre operators underestimate this risk because adiabatic coolers are a relatively newer technology.

What accreditations should I look for when choosing a Legionella testing laboratory for my data centre?

You should look for UKAS ISO/IEC 17025 accreditation for water testing (which guarantees the laboratory's methods and results meet international standards), UKAS ISO/IEC 17020 accreditation for inspection services, and registration with the Legionella Control Association (LCA). The Testing Lab holds all three of these credentials. UKAS accreditation is particularly important because test reports from non-accredited laboratories may not be accepted as evidence of compliance by the HSE or insurance underwriters.

How much does a Legionella risk assessment cost for a data centre?

The cost of a Legionella risk assessment for a data centre depends on the size and complexity of the water systems on site — a single-site facility with one cooling tower will cost considerably less than a multi-tower hyperscale campus with multiple closed-circuit systems and humidifiers. The Testing Lab provides tailored quotations following a brief scoping conversation. For data centre operators procuring through the public sector, TTL's appointment to Fusion21's Building Safety and Compliance Framework may streamline the procurement process.