Tracking Occupancy in UK Buildings for Emergency Scenarios

“Knowing Who Is On Site — Legal Requirements, Risks & Best Practice”

Executive Summary

In the United Kingdom, owners, occupiers and managers of buildings have a variety of legal duties around health & safety, fire safety, emergency planning and building safety. One key dimension of those duties — sometimes implicitly addressed, sometimes explicit — is the ability to account for who is present in a building or site at any given time, and to incorporate that knowledge into emergency response planning (e.g., evacuation, search & rescue, roll-call, emergency services handover).
This white paper:

reviews the principal UK regulatory frameworks relevant to occupancy tracking during emergencies;
identifies where the law explicitly or implicitly requires knowledge of who is on site;
highlights operational, technical and governance issues;
presents recommendations for compliance and effective practice.

1. Regulatory & Legal Context

1.1 Health & Safety at Work etc. Act 1974 (HSWA)

Under the Health and Safety at Work etc. Act 1974 the general duties are placed on employers (section 2), persons in control of premises (section 4) and others to ensure, as far as is reasonably practicable, the health, safety and welfare of persons at work and of other persons affected by the undertaking.

Although it does not explicitly mention “knowing who is on the premises at any given time”, the duty to provide safe means of access and egress, safe systems of work, and to respond to emergencies implies that building/occupancy information is relevant.

1.2 Regulatory Reform (Fire Safety) Order 2005 and subsequent fire-safety regulations

The Regulatory Reform (Fire Safety) Order 2005 (often “Fire Safety Order”) places a duty on the “Responsible Person” to carry out fire risk assessments, make arrangements for evacuation, ensure means of escape, detection and fire-fighting equipment, etc.
For example, guidance in London emphasises that the responsible person must “ensure the safety of people in the event of fire.”
Later regulations such as the Fire Safety (England) Regulations 2022 expand the duties for higher-risk buildings (e.g., secure information boxes, floor plans, building plans) and apply to residential buildings over a threshold height.
While these regulations focus on fire safety and structural information, they provide a foundation for expecting that building managers should know who is present, or at least be able to account for occupants (residents, visitors) in an emergency evacuation.

1.3 Building Safety Act 2022 & Higher-Risk Building Regime

The Building Safety Act 2022 introduces a new regulatory regime for “higher-risk buildings” (in England) — typically those 18 metres or more in height or 7 storeys plus, and containing at least two residential units.
Under this regime, key duties include: registration of the building with the Building Safety Regulator, keeping the “golden thread” of information about the building, safety case reports, mandatory occurrence reporting, residents’ engagement strategy, etc.
While the Building Safety Act does not explicitly specify that you must know exactly who is in the building at all times, the standard of accountability, information management, and assurance of occupant safety points strongly toward occupancy tracking (or at least roll-call capability) being a sensible expectation.

1.4 Emergency Planning & Incident Response – Civil Contingencies

The Civil Contingencies Act 2004 sets out duties for local responding organisations and emergency planning.
For large sites (events, major workplaces, critical infrastructure) the need to know who is present (and who might need rescue) is embedded in “planning for incidents and emergencies” guidance published by the Health and Safety Executive (HSE). HSE

1.5 Summary of Legal Requirement to Track Occupancy

In summary:

There is no single UK law that simply states “you must at any time know exactly how many and which persons are on a building/site”.
However, combining the duties of safety, fire risk, building safety and emergency planning implies that a responsible organisation must have systems and information enabling meaningful roll-call or occupancy accounting in emergency scenarios.
For higher-risk buildings and critical sites, the regulatory expectation is stronger (golden thread, detailed records, evacuation plans) and tracking occupant presence is best practice.

2. Why “Knowing Who-Is-On-Site” Matters for Emergencies

2.1 Rapid Evacuation & Search & Rescue

If an emergency (fire, explosion, structural collapse, terrorist incident) occurs, responders (internal and external) need to determine which persons might still be in the building. Having an accurate live or near-live record of occupants (employees, visitors, contractors, residents) enhances speed and effectiveness of evacuation, reduces risk of missing persons, aids emergency services handover and improves accountability for duty-holders.

2.2 Accountability & Duty to Protect

Under the Fire Safety Order and HSWA, the “responsible person” may be held liable for failing to provide safe systems of work or safe premises. Even if occupancy is not explicitly tracked, causing an evacuation scenario where persons cannot be accounted for could lead to significant legal and reputational risk.

2.3 Regulatory Inspections & Evidence

Inspectors (from fire services, HSE, building safety regulator) may ask for records of evacuation drills, occupant counts, roll-calls, building plans, information boxes. Absence of occupancy information may hamper compliance demonstration.

2.4 Insurance, Business Continuity & Resilience

From a business continuity standpoint, knowing who was in a building at time of incident assists incident investigation, insurance claims, and internal investigation and recoverability.

3. Practical Legal / Compliance Considerations

3.1 Building Types and Scope

Workplaces: Employers and persons in control of premises must ensure safe means of access/egress; occupancy data helps.
Residential multi-occupied buildings (especially high-rise): The Fire Safety (England) Regulations 2022 apply for buildings with 2+ domestic premises, and additional obligations for >11 metres height. GOV.UK+1
Higher-Risk Buildings under Building Safety Act: Specific regime for buildings ≥18 m / 7 storeys. info.pennington.org.uk+1
Events / large gatherings: The HSE guidance for event safety includes occupancy and evacuation planning. HSE

3.2 Records, Plans and Information

Evacuation plans: Under the Residential Personal Emergency Evacuation Plans (PEEPs) regulation (England, 2025) the responsible person must prepare building emergency evacuation plans including, for example, whether relevant residents are present.
Building information: Under the “Keeping Information about a Higher-Risk Building” guidance, digital records (“golden thread”) must be maintained.
Fire risk assessments: Fire risk assessment records must be kept where required.

3.3 Data Protection, Privacy & GDPR

Tracking occupancy inevitably involves personal data (names, vehicle registration, arrival/departure times). Organisations must ensure that processing is lawful, fair and transparent under the UK General Data Protection Regulation (UK GDPR) and related legislation. For example, the PEEPs regulation explicitly notes that evacuation-plan obligations “do not authorise data processing which would contravene data protection legislation”.
Therefore, occupancy tracking systems must consider: data minimisation, purpose limitation, retention policies, access control, secure storage, deletion of outdated records.

3.4 Technology and Systems — implied expectation

While not mandated by statute, in practice occupancy tracking may involve: visitor-registration systems, badge in/out systems, turn-stile logs, digital check-ins, mobile apps, emergency muster-points roll-call systems. The responsible person must ensure the system is reliable and can be used in an emergency scenario (e.g., roll-call during evacuation).

3.5 Enforcement and Liability

If a building manager fails to maintain safe evacuation arrangements, and persons cannot be accounted for during an emergency, enforcement action may be taken under fire-safety or health & safety legislation. For high-risk buildings breaches under the Building Safety Act regime may lead to penalties, and the accountable persons may be prosecuted or served improvement notices.

4. Gaps, Challenges & Risks

4.1 Lack of Explicit Statutory “Occupancy Roll-Call” Mandate

There is no regulation that simply states “you must know exactly who is in the building at all times”. This leaves some interpretation: some organisations may not have full systems in place or may neglect this dimension until an incident happens.

4.2 Visitor and Contractor Management

Buildings often have multiple categories of persons: employees, residents, contractors, visitors. Tracking contractors and visitors (especially transient ones) is more challenging. Without good systems, persons could be missed in roll-calls.

4.3 Data Privacy vs Safety Trade-Off

High-fidelity occupancy tracking can raise privacy concerns (who has access, retention of logs, biometric systems, CCTV tracking). Organisations must balance compliance with data-protection law and practical safety needs.

4.4 Technology Reliability & Human Factors

Systems can fail (badge readers, turn-stiles, mobile apps). Also, in an emergency scenario, occupants may evacuate without checking out, or systems may not provide real-time data. Evacuation chaos may degrade roll-call reliability.

4.5 Multi-occupancy, Mixed-Use and Large Sites

In large campuses, mixed-use buildings, or multi-tenant sites, coordination between different occupiers/landlords is required. The responsible person must ensure log-sharing, coordination of evacuation, and occupancy data across disparate groups.

5. Recommendations & Best Practice

5.1 Establish Clear Ownership and Accountability

Identify the Responsible Person (for fire safety) and any Accountable Person(s) under the Building Safety regime.
Define who is responsible for occupancy tracking, visitor/contractor management, evacuation roll-calls, muster-point accountability.
Ensure roles include updating and testing occupant-roll systems, ensuring they are integrated into emergency plans.

5.2 Implement Robust Occupancy Tracking Systems

Use digital visitor-management systems (check-in/check-out), badge access logs, turn-stile systems, mobile sign-in for contractors.
Ensure system can generate reports of “who is in the building right now” or as near-real-time as practicable.
Include procedure for contractors/visitors to sign out or be swept at exit.
Integrate occupancy logs into muster/evacuation roll-calls.

5.3 Integrate Occupancy Data into Emergency Planning

Build evacuation and emergency response plans assuming the occupancy list will support muster location, missing-person search, handover to emergency services.
Regularly drill evacuation, including roll-call of occupants and verification of occupant lists.
Ensure data/information is accessible (on-site, off-site) in an emergency: e.g., printed list, mobile access, cloud backup.

5.4 Data Governance & Privacy Compliance

Conduct a data-protection impact assessment (DPIA) for the occupancy-tracking systems.
Limit data to what is necessary (e.g., name, organisation, badge number, time in/out), retain for defined period.
Secure data, define who can access occupancy logs.
Include visitor/contractor terms that reference data-collection for safety/emergency purposes.
Regularly purge from system those no longer relevant.

5.5 Coordination with External Emergency-Responders

Provide building plans, evacuation procedures and occupant-roll processes to local fire & rescue service/local resilience forum as appropriate.
Consider secure information box requirements under Fire Safety (England) Regulations 2022 (for higher-rise residential).
Ensure that occupant data can be given to responders in a way that supports rapid search/rescue (while respecting data-protection rules).

5.6 Review, Audit and Continuous Improvement

Regularly review occupancy-tracking system effectiveness (e.g., after drills or real incidents).
Audit whether visitor/contractor sign-in/out is reliable.
Update system and processes to account for changes (new tenants, new entrances, different shift patterns, remote sign-in).
In the case of higher-risk buildings, ensure that the “golden thread” of building-information (including occupancy-data capability) is maintained.

5.7 Communication & Training

Train staff, security, reception, contractors on sign-in/out procedures, emergency muster arrangements, what to do if someone is missing.
Communicate to all occupiers (tenants, visitors) the requirement to check in/out, and the purpose (their safety).
Include occupancy-tracking and muster procedure in induction for new tenants, staff and regular contractors.

6. Case Study / Illustration (Hypothetical)

Company X occupies a multi-storey commercial office building (10 floors). They implement:

Digital visitor-management system: visitors sign in at reception, badge printed, sign out at exit.
Contractor check-in/out via mobile QR code.
Badge-access system logs employees entering and exiting.
At the fire-alarm signal, security pulls up live list of current occupants (staff + visitors + contractors) and conducts roll-call at designated muster points by floor.
If someone is missing, search teams check the live log for last known location and inform fire-services.
Data is retained for 30 days and then archived; visitor names purged after 90 days.
This system supports compliance with HSWA, fire-safety duties and ensures accountability in an emergency.

7. Conclusion

Although UK law does not contain a universal “you must track every person on site at all times” clause, the combination of health & safety, fire-safety, building-safety and emergency-planning regulation creates a strong expectation that building owners/occupiers must be able to account for occupant presence and non-presence in emergency scenarios.
Implementing a reliable occupancy-tracking system, integrated into evacuation/emergency plans, and governed by appropriate privacy/data-protection controls, is therefore not only a best practice—it is a key element of compliance and risk management.
In an era of increasing regulatory scrutiny (especially for high-rise/higher-risk buildings) and evolving threats (fire, structural failure, major events, terrorism), having accurate, real-time or near-real-time occupancy visibility may mean the difference between an effective safe evacuation—and a life-threatening incident.