The Freedom of Information Act 2000 gives anyone — not just journalists or campaigners — a legal right to ask a public authority what information it holds and to be given a copy, subject to specific exemptions. It’s a different legal right from a Data Subject Access Request, which only lets you see information held about you personally.
Which organisations the right applies to
The Freedom of Information Act 2000 applies in England, Wales and Northern Ireland (Scotland has its own equivalent, the Freedom of Information (Scotland) Act 2002), and covers what the Act calls “public authorities” — this includes government departments, local councils, the NHS, state schools, universities, the police, and a long list of other public bodies. It doesn’t extend to purely private companies, even ones delivering a public service under contract, unless the contract specifically brings them within scope — a distinction worth checking before assuming a request will succeed.
How to actually make a valid request
Under section 8 of the Act, a request only has to meet a few basic conditions to be valid: it must be in writing (which includes email), it must state your real name, it must include an address for correspondence, and it must describe clearly what information you’re asking for. GOV.UK’s own guidance is explicit that you don’t need to mention the Freedom of Information Act by name, or use any particular form of words — an ordinary, clearly worded written request to the right organisation is enough to trigger the legal duty to respond.
The 20 working day response deadline
Once a valid request is received, the public authority generally has 20 working days to respond, under section 10 of the Act. The ICO’s guidance counts the first working day after the request arrives as day one. In some circumstances involving a public interest balancing test on a qualified exemption, an authority can extend this to a “reasonable” further period, and the Secretary of State has power to extend the limit to a maximum of 60 working days by regulation — but a straightforward request without a genuinely contested exemption should be answered within the standard 20 working days.
When a request can be refused on cost grounds
Authorities don’t have to comply if answering would exceed a set cost limit, calculated at a notional £25 per hour of staff time. According to the ICO, the limit is £600 (24 hours) for central government departments, Parliament and the armed forces, and £450 (18 hours) for all other public authorities, including local councils, the NHS and police forces. If a request would cost more than this to answer, the authority can refuse it on cost grounds alone — though it should normally tell you this and, where reasonable, help you refine the request into something that would fall under the limit.
Exemptions: what can lawfully be withheld
- Absolute exemptions — information doesn’t have to be disclosed at all if it falls under these, regardless of public interest. Examples include information already reasonably accessible by other means, information covered by court records, and personal information about a third party (which is separately protected under data protection law).
- Qualified exemptions — these can be applied, but only where the public interest in withholding the information outweighs the public interest in disclosure. Examples include national security, law enforcement, the formulation of government policy, and commercial interests.
- Neither confirm nor deny — in narrow circumstances, an authority can decline to even confirm whether it holds the requested information, if doing so would itself cause the harm an exemption is designed to prevent.
What to do if a request is refused or ignored
If an authority refuses a request, it must explain which exemption it’s relying on and offer an internal review process. If you’re not satisfied with the outcome of that internal review, you can complain to the Information Commissioner’s Office (ICO), which is the independent regulator responsible for enforcing the Act. The ICO can investigate and, where it finds the authority has acted unlawfully, issue a decision notice requiring disclosure or ordering the authority to properly reconsider the request. Beyond the ICO, there’s a further right of appeal to the First-tier Tribunal (Information Rights) if either side disagrees with the ICO’s decision.
FAQs
Do I have to explain why I want the information?
No. The right under the Freedom of Information Act is applicant and motive-blind in almost all cases — you don’t need to give a reason, and the authority generally isn’t allowed to ask why you want the information before deciding whether to release it.
Can I ask a private company for information under FOI?
Generally no, unless that company has been specifically designated as a public authority for FOI purposes, or the information relates to a public contract where the authority itself holds relevant records. Purely private businesses sit outside the Act’s scope.
What’s the difference between an FOI request and a Subject Access Request?
An FOI request asks a public authority for information it holds generally, on any subject. A Subject Access Request, made under UK GDPR and the Data Protection Act 2018, only lets you see personal data held specifically about you, and can be made to private organisations as well as public ones.