Freedom of Information - Frequenty asked questions (FAQs)

Frequently asked questions about Freedom of Information (FOI) requests and Subject Access Requests (SAR)

The Freedom of Information Act, Environmental Information Regulations and INSPIRE Regulations give you rights to access official information.

  • You can ask for any information you think a public authority may hold. The right only covers recorded information which includes information held on computers, in emails and in printed or handwritten documents as well as images, video and audio recordings.
  • You should identify the information you want as clearly as possible.
  • Your request can be in the form of a question, rather than a request for specific documents, but the authority does not have to answer your question if this would mean creating new information or giving an opinion or judgment that is not already recorded.
  • Some information may not be given to you because it is exempt, for example because it would unfairly reveal personal details about somebody else.
  • Is the information you want already available, for example, on the authority’s website?
  • Is the information you want your own personal data?
  • If your request is for information about yourself, such as your medical records, you should make a subject access request under the Data Protection Act.
  • Is the authority likely to have the information?
  • Is the information you want suitable for general publication?
  • Some information, such as records about a dead relative, or documents you need for legal purposes, may not always be available under the Act. However, you may have a right to see the information you want under other legislation. The public authority holding the information you want should advise you.
  • Contact the relevant authority directly;
  • Make the request in writing, for example in a letter or an email. You can make a verbal or written request for environmental information;
  • Give your real name; and
  • Give an address to which the authority can reply. This can be a postal or email address.

Most people will exercise their rights responsibly but we also recognise that some individuals and organisations submit requests which may, whether by accident or design, cause a public authority an unjustified or disproportionate level of disruption or irritation. Some requests can cause distress to members of staff in a public authority.

The FOIA has a built in safeguard to protect public authorities from having to deal with such requests (called vexatious requests under Section 14). In the case of the EIR, there is an equivalent provision for requests which are manifestly unreasonable [Regulation 12(4)(b)].

It can be difficult for requesters to understand how information is labelled and organised by public authorities - the Act contains a provision that ensures that public authorities must consider whether they should provide you with advice and assistance, within reasonable limits.

Nonetheless, the amount of time and resources that a public authority has to expend in responding to a request should not be out of all proportion to that request’s value and purpose.

If your request does lack any serious or clear purpose or if it is not focused on acquiring information, then the FOIA and EIR are probably not an appropriate means through which to pursue your concern. You might do better to explore whether there are other more suitable channels through which to take up the issue with the authority.

You should also bear in mind that the FOIA includes a safeguard against requests which exceed the cost limits for compliance (Section 12). The equivalent provision in the EIR is once again [Regulation 12(4)(b)] - manifestly unreasonable requests .

Therefore, if you are planning to ask for a large volume of information, or make a very general request, you should first consider whether you could narrow or refocus the scope of the request, as this may help you get what you really want and reduce any unnecessary burden or costs on the authority. Alternatively, you could try approaching the public authority for advice and assistance to help you reduce the scope of your request and cut down the cost of compliance – they have a duty to consider what advice and assistance they can provide.

Although you don’t have to say why you want the information, if you are happy to do so it might avoid a lot of wasted time and be more likely to get you what you want.

Yes, a public authority can charge you for the costs of sending the information, such as photocopying and postage. These are known as 'disbursements'.

Information request dos and don’ts
Do Don't
Find out who to send your request to. If you address your request directly to the appropriate contact within the authority then you may receive a prompter response. Use offensive or threatening language.
Include your name, address and other contact details in the request. Level unfounded accusations at the authority or its staff.
Clearly state that you are making your request under the Freedom of Information Act/Environmental Information Regulations. Make personal attacks against employees.
Be as specific as possible about the information you want rather than asking general questions. Try to include details such as dates and names whenever you can. It may also assist the authority in identifying the information if you explain the purpose behind your request. Use FOI to reopen grievances which have already been fully addressed by the authority, or subjected to independent investigation with no evidence of wrongdoing being found.
Re-read your request to check for any wording which is unclear or open to interpretation. Make assumptions about how the authority organises its information or tell them how to search for the information you want.
Use straightforward, polite language; avoid basing your request or question on assumptions or opinions, or mixing requests with complaints or comments. Bury your request in amongst lengthy correspondence on other matters or underlying complaints
Specify whether you have any preferences as to how you would like to receive the information, for example if you would prefer a paper copy or to receive an email. Use requests as a way of ‘scoring points’ against an authority
Give the authority ample opportunity to address any previous requests you have made before submitting new ones. Send ‘catch-all’ requests for information (such as ‘please provide me with everything you hold about ‘x’) when you aren’t sure what specific documents to ask for. If in doubt, try searching on the authority’s website or enquiring whether any indexes and file lists are available. Alternatively, ask the authority for some advice and assistance in framing your request.
Stay focused on the line of enquiry you are pursuing. Don’t let your attention start to drift onto issues of minor relevance. Submit frivolous or trivial requests; remember that processing any information request involves some cost to the public purse.
Think about whether making a request is the best way of achieving what you want. If you have an underlying complaint then it may be better to just take your complaint to the relevant ombudsman and let them investigate. Disrupt a public authority by the sheer weight of requests or the volume of information requested. Whether you are acting alone or in concert with others, this is a clear misuse of the Act and an abuse of your ‘right to know’.
Aim to be flexible if the authority advises that it can’t meet the full request on cost grounds and asks you to narrow it down. Try to work with the organisation to produce a streamlined version of the request which still covers the core information that is most importance to you. Deliberately ‘fish’ for information by submitting a very broad or random requests in the hope it will catch something noteworthy or otherwise useful. Requests should be directed towards obtaining information on a particular issue, rather than relying on pot luck to see if anything of interest is revealed.
  Make repeat requests unless circumstances, or the information itself, have changed to the extent that there are justifiable grounds to ask for the information again.

The authority must reply to you within 20 working days. It may:

  • give you the information you’ve asked for;
  • tell you it doesn’t have the information;
  • tell you that another authority holds the information or transfer the request on your behalf;
  • under the Freedom of Information Act, say that it has the information and offer to provide it if you pay them a fee (but there are rules about what they can charge);
  • Under the Environmental Information Regulations, make a reasonable charge for providing information in accordance with their published schedule of charges. Note: If the authority allows you to view a public register or other information in person, at a place of their choice, it cannot charge for this;
  • refuse to give you the information, and explain why; or,
  • Under the Freedom of Information Act, say that it needs more time to consider the public interest in disclosing or withholding the information, and tell you when to expect a response. This should not be later than 40 working days after the date of your request. It can only extend the time limit in certain circumstances, and it must explain why it thinks the information may be exempt;
  • under the Environmental Information Regulations, say that it needs more time as the information requested is particularly complex and there is a lot of information to provide. In such cases the time limit can be extended by a further 20 working days as long as the authority respond within the initial time limit stating when it believes it will be able to respond in full.

Under equality law an organisation has a duty to make sure that its services are accessible to all service users. You can request a response in a particular format that is accessible to you, such as Braille, large print, email or audio format.

If you think that an organisation has failed to make a reasonable adjustment, you can make a claim under the Equality Act (or Disability Discrimination Act in Northern Ireland).

Further advice is available from:

The Freedom of Information Act recognises that there will be valid reasons why some kinds of information may be withheld, such as if its release would prejudice national security or damage commercial interests. For some exemptions the public authority must consider whether the public interest in withholding the information outweighs the public interest in releasing it. If it decides that the information cannot be released it must tell you and explain why. Public authorities are not obliged to deal with vexatious or repeated requests or in some cases if the cost exceeds an appropriate limit. In addition the Act does not provide the right of access to personal information about yourself. This is instead available under the Data Protection Act again, subject to certain exemptions, and is known as a subject access request.

Yes. You should first complain to the authority and ask it to conduct an internal review. For freedom of information complaints we recommend that you do this as soon as possible and within two months of receiving the authority’s final response.

For environmental information complaints you should make your complaint within 40 working days.

The Information Commissioner’s Office recommends that public authorities carry out internal reviews within 20 working days. Under Environmental Information Regulations there is a legal requirement that internal reviews must be carried out as soon as possible and within 40 working days. The authority cannot charge for carrying out an internal review.

You have the right to find out if an organisation is using or storing your personal data. This is called the right of access. You exercise this right by asking for a copy of the data, which is commonly known as making a ‘subject access request’.

You can make a subject access request to find out what data is held and how it is used. You may make a subject access request before exercising your other information rights.

You can make a subject access request verbally or in writing. If you make your request verbally, we recommend you follow it up in writing to provide a clear trail of correspondence. It will also provide clear evidence of your actions.

You might not want all the personal data that the organisation holds about you. It may respond more quickly if you explain this and identify the specific data you want.

When making a subject access request, include the following information:

  • Your name and contact details.
  • Any information used by the organisation to identify or distinguish you from other people with the same name (account numbers etc).
  • Any details or relevant dates that will help it identify what you want.

You can ask an organisation for access more than once. However, it may be able to refuse access if your request is, as the law says, ‘manifestly unfounded or excessive’.

If you are thinking of resubmitting a request, you should think about whether:

  • It is likely that your data has changed since your last request
  • Enough time has passed for it to be reasonable to request an update on
  • how your data is being used, or
  • The organisation has changed its activities or processes recently.

If you are unhappy with how the organisation has handled your request, you should first make a complaint to it.

Having done so, if you remain dissatisfied you can make a complaint to the ICO.

You can also seek to enforce your rights through the courts. If you decide to do this, we strongly advise that you seek independent legal advice first.

If an organisation reasonably needs more information to help it find your data or identify you, it has to ask you for the information it needs. It can then wait until it has all the necessary information before dealing with your request.

When it responds to your request, the organisation should provide you with a copy of your data. It may do this electronically. If you need your data in another format, you must ask if this is possible.

You are also entitled to be told the following things:

  • What it is using your data for.
  • Who it is sharing your data with.
  • How long it will store your data, and how it made this decision.
  • Information on your rights to challenge the accuracy of your data, to have it deleted, or to object to its use.
  • Your right to complain to the ICO.
  • Information on where your data came from.
  • Whether your data is used for profiling or automated decision making and how it is doing this.

If it has transferred your data to a third country or an international organisation, what security measures it took.

An organisation may refuse your subject access request if your data includes information about another individual, except where:

  • the other individual has agreed to the disclosure, or
  • it is reasonable to provide you with this information without the other individual’s consent.

In deciding this, the organisation will have to balance your right to access your data against the other individual’s rights regarding their own information.

The organisation can also refuse your request if it is ‘manifestly unfounded or excessive’.

In any case the organisation will need to tell you and justify its decision. It should also let you know about your right to complain to the ICO, or through the courts.

An organisation has one month to respond to your request. In certain circumstances it may need extra time to consider your request and can take up to an extra two months. If it is going to do this, it should let you know within one month that it needs more time and why. For more on this, see the ICO guidance on Time Limits.

A copy of your personal data should be provided free. An organisation may charge for additional copies. It can only charge a fee if it thinks the request is ‘manifestly unfounded or excessive’. If so, it may ask for a reasonable fee for administrative costs associated with the request.

FOI = Freedom of Information

The Freedom of Information Act gives a person the right to ask any public sector organisation for all the recorded information they have on any subject.

Anyone can make a request for information – there are no restrictions on your age, nationality or where you live.

If you ask for information about yourself, then your request will be handled under the Data Protection Act, see Subject Access Request.

We have 20 working days to respond to a Freedom of Information Request.

EIR = Environment Information Requests

These requests cover factors which effect the environment and cover a wide variety of things from air quality to the Health & Safety of people.

We have 20 working days to respond to an Environmental Information Request.

However,under the Environmental Information Regulations 2004, this can be extended to 40 days if the information is complex and makes it impracticable for us to respond.  In some circumstances a fee may be payable and this would be required to pay before we will proceed to deal with your request.

SA = Subject Access Requests

When a person makes a request for their own information, this is a Subject Access Request under the Data Protection Act.

One of the main rights which the Data Protection Act gives to individuals is the right of access to their personal information. An individual can send you a subject access request requiring you to tell them about the personal information you hold about them, and to provide them with a copy of that information.

We must respond to a valid subject access request within one calendar month of receiving it.

Proof of Life Requests

The majority of these requests are received from the Police requesting information about a person.

There is no set response time, however we do aim to treat as urgent and respond as soon as possible or respond by their deadline requested.

These requests are treated as confidential.