Lightning protection for data centers, starting with the risk assessment
A data center rarely burns after a strike. It goes dark because a surge came in on a feeder or a carrier cable and reached the racks. This guide shows how IEC 62305, NFPA 780 and AS 1768 each weigh that threat, and which measures the assessment rewards.
Lightning protection for data centers is mostly about the cables and the electronics, not the roof: one surge on a power or data line can stop service with no fire and no direct strike.
A data center's product is uptime. Its building usually survives a strike untouched, while the surge travels in on a utility feeder, a generator connection or a carrier's copper line and fails the equipment that keeps customers online. So the question a lightning risk assessment answers here is less "will the building burn" and more "how often could lightning take the load down, and which entries does that risk come through".
This guide covers the assessment under IEC 62305-2:2024, then what NFPA 780-2026 and AS 1768:2021 ask of the same facility. It explains which result decides the protection, why failure of the internal systems leads, how the many incoming lines drive the figures, how the study supports uptime targets, and what makes a real facility harder to model than a plain building.
Why a data center is an extreme case
A data center puts its value where lightning finds it easiest to cause harm: in sensitive equipment fed by many long cables. Three features set it apart.
Continuity is the asset
What a data center cannot afford to lose is service. A failed UPS module or a dead core switch can stop every customer at once, so the study measures how often lightning could interrupt the load, not how often it could damage the shell.
Redundancy does not stop a surge
Dual feeds, generators and UPS keep power flowing through a fault, but a surge can arrive on more than one path in the same instant. Duplicated equipment on the same unprotected entries fails together.
Many entries, one data hall
Utility feeds, generator interconnects, several carriers' lines into the meet-me room, and control cables from rooftop plant all end up near the same racks. Each is a separate way in, and each needs its own place in the model.
The frequency of damage carries the weight, and the economic case with it
IEC 62305-2:2024 gives two results. The combined risk R covers injury to people and physical damage to the structure. The frequency of damage F covers the internal systems, counting how often a strike could put them out of action. Edition 3 keeps three types of loss: injury to human beings (L1), physical damage (L2) and failure of internal systems (L3). The economic loss that the 2010 edition scored on its own is gone as a separate type.
In a data center, F usually decides the study. Under the 2024 edition it is the figure that carries loss of service and pure economic loss, which is exactly what an outage costs: missed service levels, lost transactions, customers moving elsewhere, and the recovery work. R still has to pass, because engineers, security staff and visitors are on site, but a lightly staffed data hall seldom produces an R that sets the protection. A hospital sits at the other end of the scale, with life safety leading and internal systems close behind.
For how R and F are built from their components, read the IEC 62305-2 risk method. For the damage and loss model underneath, start with what is IEC 62305.
Why internal-system failure is the heart of it
IEC 62305-2:2024 (Ed.3) clause 5.2 groups what a strike can do into four causes of damage: shock to people from a direct flash (D1D) or from touch and step voltages (D1T), physical damage such as fire or explosion (D2), and the failure of electrical and electronic systems caused by the lightning electromagnetic pulse, or LEMP (D3). In most buildings shock and physical damage lead the assessment. In a data center the value sits in the racks, so D3, the loss of internal systems, is the cause of damage that carries the risk, and the whole study is shaped around reducing the chance and the consequence of that failure.
Follow a surge through the building to see why. It can arrive on the utility service and pass the main switchboard, the UPS and the power distribution units on its way to the racks. It can arrive on a copper carrier line in the meet-me room and reach the core network. It can be induced on the control cabling that runs from rooftop chillers and the building management system down into the plant rooms. The equipment at the end of each path is built for clean power and low-voltage signals, so a surge it would shrug off at a household socket can still end service in a data hall.
The assessment credits measures along those paths. Surge protective devices at the service entrance take the bulk of the energy, and further devices at the distribution boards that feed critical loads take what is left. A single bonding network ties racks, cable trays, raised floor supports and building steel to one reference, so no voltage difference opens up between equipment that talks to each other. Screened routes and a lightning protection zone (LPZ) scheme put the data hall in the innermost zone. IEC 62305-4 sets out these measures against LEMP, and the risk method lowers the probability of internal-system failure for each one in place.
For how surge devices are graded and coordinated, see SPD types under IEC 62305. For the zone scheme, see lightning protection zones (LPZ).
Incoming lines are how the surge gets in
Data centers are built for diverse routes. Two utility feeds from different substations, generator connections, and lines from several carriers arriving by different paths all protect against an ordinary outage. To lightning, each of those routes is one more conductor that can carry a surge in from far away. That is why the line-related components, not a flash to the roof, usually hold most of a data center's risk.
What matters for each line is what it is made of and how far it runs. A long overhead feeder collects far more than a short buried one, and a screened cable bonded at the entry lets less through than a bare one. A fibre cable with no conducting members gives a surge no metal path, which is why NFPA 780-2026 A.4.19.2.4 uses it as an example of a line that might not need a surge device at the entrance. Armoured fibre and copper lines do have a metal path and belong in the model.
So the inputs that decide a data center assessment are the count of separate entries, the length, installation and screening of each, and whether an SPD or surge protector guards it at the boundary. A telecom site raises a similar question for the lines feeding its equipment shelter, on a much smaller scale.
Lightning protection for data centers under NFPA 780 and AS 1768
Neither standard has a data center chapter. Both score the facility through the losses it can suffer, and both have clauses that bear on electronics and lost service. Each cell is our summary of the clause cited.
| What the method weighs | NFPA 780-2026 Annex L | AS 1768:2021 |
|---|---|---|
| Electronic contents | Contents coefficient C3 = 3.0 in the simplified risk assessment for computer or electronics, the top value short of cultural items (Table L.5.1.2(b)) | Data centers named as a source of significant economic loss (B.2.3.3(iii)) |
| Need for continuity | Consequence coefficient C5 = 5.0 where continuity of facility services is required (Table L.5.1.2(d)); continuity of critical services listed as a reason to consider protection whatever the result (L.1.1) | Surge protection is recommended when the owner could not accept the financial cost of equipment lost to a surge (4.2.1(iv)) |
| Which risk carries it | R2 loss of service, tolerable 10⁻³ by default, and R4 economic loss, which has no default and takes the owner's value (Table L.6.2, L.6.3) | L4 economic loss, typical tolerable 10⁻³, which the owner may set stricter (Table 2.1 and its NOTE); L2 applies only to public service utilities (B.2.3.3 NOTE) |
| Internal-system components | The four internal-system components (RC, RM, RW, RZ) count in R2 and R4, and in R1 only where system failure endangers life (L.6.5) | Equipment failure (D3) feeds loss of service and economic loss; from flashes near the structure or a service it counts toward human life only for hospitals and explosion risks (Table B.2, note c) |
| Equipment sensitivity | Typical withstand UW = 1.5 kV for computer equipment (notes to Tables L.6.7.7 and L.6.7.8); PM = 1 when UW is unknown or below 1.5 kV (L.6.6.2.4) | Fire damage factor for data centers 0.5, the highest economic option (C.3.2.5.4); the overvoltage list names no data center row |
| When to look again | Annual inspection or testing unless the AHJ sets another interval (1.7) | Reassess after changes to computing facilities (5.4.3(d)); inspect at least every two years (5.4.4) |
Once protected, every entry gets a device
SPDs go at every power service (4.19.2.1) with a nominal discharge current no lower than 20 kA (8/20 µs) on each phase (4.19.2.6), and surge protectors go on every signal, data and communications line that enters (4.19.4.1), rated at least 10 kA Imax (4.19.4.3), unless the service provider has already made other provision (4.19.4.1.1). A.4.19.2.3 adds that SPDs should also be considered at the branch distribution feeding equipment whose failure the operation cannot afford. See NFPA 780 surge protection.
Equipment rooms as protection zones
Informative Annex J, written for heavily automated buildings, treats equipment rooms holding servers and telecommunications gear as zones (J.6, J.6.1) and centres their bonding on a single ground bus bar near the service entrance (J.6.1.1.1). It is guidance, not a requirement, but it maps closely onto a data hall.
Is a data center a critical facility?
L.5.3.1 lists telecommunications facilities, telephone and internet service providers among them, as critical, and L.5.3.2 advises protecting a critical facility or running the detailed assessment. A carrier hotel may fit that list; an enterprise data hall may not. The owner and the authority having jurisdiction decide.
When AS 1768 requires surge protection
Surge protection shall be fitted where the risk assessment calls for it and wherever the facility is protected from direct strikes. It should also be fitted where Ng exceeds 2 with overhead services, or where surge damage would hit safety, a public utility or the owner's finances beyond what is tolerable. See AS 1768 surge protection.
A data center does not fail because the building burns. It fails because the load drops.
The measures that move the result
In a data center almost every measure that counts keeps surges away from the equipment. The assessment shows which ones a given facility needs, entry by entry.
SPDs at the entrance and at critical boards
Devices at the service entrance take the bulk of a surge, and coordinated devices at the boards feeding UPS and IT loads take the remainder. Surge protectors on each copper carrier line do the same job for data.
One bonding network
Racks, cable trays, raised floor supports and building steel tied to one reference keep connected equipment at the same potential. An SPD only works well when the earth it diverts to is the same earth the equipment sees.
Screened routes and an inner zone
Screened cable routes, and a zone scheme that places the data hall innermost, cut the induced surge before any device has to clamp it. Control cabling from rooftop plant needs the same care as the feeders.
Protection sized by the numbers
The result shows which entries carry the risk. A carrier line with its own SPD may already pass, while a long unscreened feeder does not, so the spend goes where the figures point.
How the assessment supports uptime expectations
Data centers are built and sold on availability. Uptime tiers and the redundancy behind them, duplicated power paths, backup generation, redundant cooling, exist to keep service running through a fault. Lightning is one of the threats to that availability, and it is one the redundant mechanical and electrical design does not fully answer, because an induced surge can reach equipment on more than one power path at once.
An IEC 62305 assessment supports the availability target by putting a number on it. It estimates how often a strike-related event could cause an outage and shows that the surge protection, bonding, shielding and zoning bring that frequency below an acceptable level. It does not replace the redundant power and cooling that uptime tiers are built on, and it is not the same exercise as a tier certification. What it gives is the recognised evidence that the lightning threat to continuity has been assessed on the numbers and controlled, rather than left as an assumption that the building is probably fine.
What makes modelling a data center different
Four features of a real facility push the model away from the simple single-box case and have to be reflected for the answer to hold up.
A large footprint
A big building over a wide plot has a large collection area, so it gathers more strikes near and on it over a year than a compact structure. The geometry of the building feeds straight into how often a dangerous event is expected.
Rooftop plant
Chillers, dry coolers and other mechanical plant on the roof are exposed equipment in their own right, with their own cabling running back into the building, and the assessment has to account for that exposure rather than treating the roof as bare.
Dense internal systems
The value and the vulnerability are concentrated in racks across many rooms, so the loss tied to internal-system failure is high and the protection of those systems carries most of the assessment.
Many connected lines
Two utility feeds, generator links and several carriers' lines each enter by their own route. Folding them into one average line hides the long unscreened one that drives the result, so the IEC 62305-2 method models each line on its own.
A data center, modelled to the clause
Questions answered
Why do data centers need lightning protection?
Which IEC 62305 risks matter most for a data center?
Can lightning damage a data center without a direct strike?
What is D3 damage and why does it lead in a data center?
How do incoming power and data lines affect data center lightning risk?
How does an IEC 62305 assessment support data center uptime tiers?
What protection measures matter most for a data center?
How do NFPA 780 and AS 1768 treat a data center?
Does Lumex™ handle data center lightning risk assessments?
The tolerable risk in IEC 62305-2 is not a fixed constant.
Clause 7.3 NOTE 1 gives RT = 1 × 10⁻⁵ per year as a
representative value of tolerable risk and adds that another value may be set once
the case has been investigated in detail. The standard's introduction then lets national or local regulations fix
RT, the tolerable frequency of damage FT
Get started today