Residential PEEPs: the 2025 Regulations explained, and what a defensible record looks like

The Fire Safety (Residential Evacuation Plans) (England) Regulations 2025 came into force on 6 April 2026. They were made under the Regulatory Reform (Fire Safety) Order 2005 and implement two recommendations from the first phase of the Grenfell Tower Inquiry: that the owner or manager of a high-rise residential building should know which residents would struggle to get out in a fire, and should have a plan for each of them.

Most people call them the Residential PEEPs Regulations, after personal emergency evacuation plans. The Regulations themselves do not use that phrase. What they create is a sequence of duties, each with its own record, and it is the records that an inspecting fire and rescue authority will ask to see.

They apply in England only.

Who the duty falls on

The duties sit with the responsible person under the Fire Safety Order: in a residential building, usually the freeholder, the housing provider, the management company or the managing agent acting for them. Where more than one organisation is responsible for a building, they are expected to cooperate, but the duty to each resident is not diluted by being shared.

A contractor carrying out fire door checks or a fire risk assessment is not the responsible person. They may do some of the work below on the responsible person’s behalf, and that is where most of the data-handling questions in this guide come from.

Which buildings

Regulation 3 defines a specified residential building as one containing two or more sets of domestic premises which is any of:

at least 18 metres tall, or
at least seven storeys, or
more than 11 metres tall where a simultaneous evacuation strategy is in place rather than stay put.

Height is measured to the top storey in the way Approved Document B sets out, ignoring storeys below ground. A mezzanine counts as a storey only when its floor is at least half the size of the largest storey above ground.

The third limb matters more than it looks. An 11-to-18-metre block that moved to simultaneous evacuation after a cladding or compartmentation finding is in scope for as long as that strategy stands, and comes out of scope when it returns to stay put. The building plan in regulation 13 is where that strategy is written down.

Who is a relevant resident

Regulation 4 is deliberately narrow. A relevant resident is someone whose only or principal home is in the building, and whose ability to evacuate without assistance in a fire is compromised by a cognitive or physical impairment or condition.

Three things follow from the wording:

It is about evacuating unaided, not about disability in general. A wheelchair user on the ground floor with a level exit may self-evacuate. A resident with dementia on the ninth floor may not, whatever their mobility.
It covers temporary conditions. A resident recovering from surgery is a relevant resident for the weeks that it lasts.
It is about the person’s home, so a carer who stays overnight, or a relative who visits, is not a relevant resident, though they may be part of the resident’s plan.

The responsible person is not expected to know this on day one. Regulation 5 asks for reasonable endeavours to identify relevant residents. The published guidance reads that as asking at move-in, reminding every household annually, and acting whenever a resident or someone acting for them asks. Every one of those attempts is a record: the letter, the date, the response or the silence. A building with no identified relevant residents and no record of having asked is not a building with no relevant residents.

The assessment, the measures and the statement

Once a resident is identified, three duties follow in order.

A person-centred fire risk assessment (regulation 6). The responsible person must offer one to every relevant resident, and must carry one out for any relevant resident who asks. It looks at two things: the risks that follow from the resident’s reduced ability to self-evacuate, and any other risk the building presents to that resident in light of their condition. It is a conversation in the flat as much as a form, and it is where the sensitive detail lives: the nature of the impairment, whether the resident can hear the alarm, use the stairs, needs one person or two, uses oxygen or a hoist.

Mitigating measures (regulation 7). After discussing the assessment with the resident, the responsible person must put in place measures that are reasonable and proportionate. The Regulations are specific about who pays: measures the responsible person funds, measures whose cost is shared among residents (allowed only where the measure benefits the majority of residents at the time), and measures the resident pays for themselves, which the responsible person need not implement unless the resident does pay. Each measure, who funds it, and whether it is in place is a record.

An emergency evacuation statement (regulation 8). The responsible person must use reasonable endeavours to agree with the resident how they will evacuate, taking the assessment and the measures into account, and must record what is agreed in writing and give the resident a copy. A statement is not the same as a plan the building imposes: if the resident does not agree, the record is of the endeavours made and the resident’s position, not of a statement.

Reviews

Regulation 9 puts the assessment, the measures and the statement on a twelve-month cycle, counted from when the statement was first recorded, or from the assessment where no approach was agreed. A review is also due whenever there is reason to think something has changed, and whenever the resident reasonably asks. An early review resets the clock.

After a review the responsible person updates the assessment, implements any further measures, updates or withdraws the statement, or tries again to agree one. Each review is itself a record, with a date the next one falls due.

Information for the fire and rescue service

Regulation 10 is the part that reaches outside the building. For each relevant resident, the responsible person must give the local fire and rescue authority exactly four things:

the flat number,
the floor number,
basic information on the degree of assistance the resident needs to evacuate, and
whether an emergency evacuation statement exists.

Two constraints shape how this is done. Sharing needs the resident’s explicit consent, so a relevant resident who declines is simply absent from what the fire service holds, and the responsible person’s record shows why. And the fire and rescue authority chooses the channel: electronically, or a hard copy in the building’s secure information box, which the responsible person must install and maintain if one is chosen and none exists.

Note what is not on the list. Not the resident’s name, not their condition, not the assessment. The fire service needs to know where to go and what kind of help to bring; it does not need the medical history.

Representatives, data protection and the building plan

Three shorter regulations round the set out.

Representatives (regulation 11). Where a resident cannot act for themselves, someone with parental responsibility, an attorney under a lasting or enduring power, or a Court of Protection deputy can make the requests and give the consents above on their behalf. Who that person is, and on what basis, is part of the resident’s record.

Data protection (regulation 12). Nothing in the Regulations requires or permits processing that would breach data protection law. In practice the assessment is special category data under UK GDPR, the responsible person is the controller, and anyone they bring in to carry out assessments is a processor. The duties above are the lawful basis for keeping the records; they are not a licence to share them with everyone who works on the building.

A building emergency evacuation plan (regulation 13). Separate from the individual statements, the responsible person must prepare a plan for the building, give the fire and rescue authority a copy, put a copy in the secure information box where there is one, and review it every twelve months and whenever it needs amending. It states the evacuation strategy, the instructions residents have been given, whether there are relevant residents in the building, and any other arrangements.

What to record

Pulling the duties together, a defensible register for one building holds:

Every identification attempt, by flat: the date, the method, the outcome, and who did it, including the households that never replied.
For each relevant resident: the person-centred assessment and its date, the measures with their funding and status, the evacuation statement or the record of trying to agree one, the date the resident was given their copy, and the next review date.
Consent: whether the resident agreed to the four items being shared, when, and in what form.
What the fire service holds: which version of the information they were given, when, and by which channel, so that it can be shown to be current.
The building plan, its versions, and when each reached the fire service and the box.
Who has looked at any of it. This is the one a housing provider’s data protection officer asks about first.

And one record of a different kind: when a resident moves out, when their information was removed, and by whom. The Regulations set no retention period; your own policy has to.

The part that breaks

Fire door checks produce records that are tedious to keep but harmless to share. These produce records that are sensitive to hold and dangerous to share widely. The failure modes are different.

The first is the spreadsheet. A register of residents with mobility conditions in a shared drive, emailed to the contractor who does the door round because they were “going round anyway”. It is the most common way this data is handled today, and it is the one an inspecting authority or a complaint will find hardest to defend.

The second is the contractor’s system. A fire risk assessor’s own software holds the assessments; a different firm does the next round; the first firm’s system still holds last year’s data about your residents, and your copy is a PDF. When the resident asks what you hold about them, you cannot answer without ringing someone.

The third is nothing happening. A statement agreed in April with a review due the following April, and nobody is counting. Twelve-month cycles across forty residents in six buildings are not something a diary handles.

Where MyQTAG fits

Briefly, because this is a guide about the Regulations rather than about software.

MyQTAG keeps a residents register on each building, held by the building owner’s own team and visible to that team only. The contractors who work on the building see one thing about its people: a liaison contact, and nothing else. There is no setting that changes this.

Against each resident the team files the person-centred assessment, the evacuation statement and each review as forms, with the resident’s health detail marked private so it never appears on anything shared outside the team. The statement’s PDF is the copy the resident is given. Review dates are computed from the records, so the register, the schedule and the team’s compliance page all show which reviews are due. The fire service information is generated from the register as a numbered document holding only the four items, for residents who gave explicit consent, with a record of when it was sent and when it went in the box. Every open of a resident’s record is logged, a resident’s data can be exported for a subject access request, and a resident who moves out is anonymised after a retention period you set.

It does not decide whether your building is in scope, it does not carry out the assessment for you, and it does not tell you what reasonable and proportionate measures are. Those are questions for you, the resident and your fire safety adviser.

Sources

The Fire Safety (Residential Evacuation Plans) (England) Regulations 2025 — the Regulations themselves, and the authority for everything above.
The Regulatory Reform (Fire Safety) Order 2005 — the responsible person, and the general duties the 2025 Regulations sit on top of.
The Home Office guidance for responsible persons and residents published alongside the Regulations, for the government’s own reading of reasonable endeavours, the assessment and the role of the fire and rescue service.

This guide is written for orientation. It is not legal advice, and where your building’s circumstances are unusual, take advice from a competent fire safety professional.