FOI for Complaints & Safeguarding Data | UK JournoHub

Last reviewed: 21 May 2026Next review due: 21 November 2026

Why complaints and safeguarding data matters

Complaints data from NHS trusts, councils, police forces, schools, and Multi-Academy Trusts can reveal systemic failures that individual cases do not. A single complaint about a hospital department may be anecdotal; a 40% year-on-year rise in complaints about the same department, combined with three referrals to the Parliamentary and Health Service Ombudsman, is a news story. Safeguarding data — the statistics on child protection referrals, care orders, and safeguarding enquiries under the Care Act 2014 — shows whether vulnerable people are being protected and whether institutions are improving or deteriorating.

Both types of data carry significant risks. Complaints data can identify specific incidents that, combined with other information, could identify the complainant or the subject of the complaint. Safeguarding data can, at insufficient levels of aggregation, identify the very people it is designed to protect — children and vulnerable adults who are often already at risk.

The approach for both is the same: request aggregate statistics, not individual records. Request category-level trends, not case-by-case detail. Apply statistical suppression thresholds before publishing. And interrogate your own data before publication to check whether it could identify anyone.

When complaints FOI requests are most useful

1Investigating a pattern of failures in an NHS trust or GP practice — complaints data shows volume and category trends.
2Examining whether a council's children's services are adequately protecting vulnerable young people.
3Assessing police complaints data to identify trends in misconduct allegations or forces with disproportionate complaint rates.
4Comparing how many complaints a school or MAT has received about a specific issue (e.g. exclusions, bullying policies).
5Cross-referencing complaints data with Ofsted or Care Quality Commission inspection outcomes.
6Establishing whether a public body is complying with its legal obligation to operate a complaints procedure.
7Identifying whether the rate of complaints upheld (vs dismissed) has changed significantly year on year.

Red flags — risks specific to safeguarding data

Data disclosed at individual-case level rather than aggregate — do not publish it without statistical suppression.
Small cell counts (fewer than 5) in any category — the combination of institution name + category + small number can identify a victim.
Data that reveals the outcome of a specific named safeguarding review or serious case review.
Any data combined with a named child, even indirectly — e.g. "the only safeguarding case at this school in this year".
An authority that has disclosed data you suspect should have been withheld — do not publish first, verify ethics first.
Requests about ongoing investigations or live criminal proceedings — s.31 law enforcement exemption is likely to apply and justified.

Complaints and safeguarding FOI checklist

My request asks for aggregate statistics, not individual case records.
I have specified that categories with fewer than five individuals should be suppressed or merged.
I have checked what data is already publicly available (Ofsted reports, CQC ratings, PHSO annual reports) before filing.
I have identified which exemptions are likely to be claimed (s.40 personal data, s.31 law enforcement, s.36 effective conduct) and prepared counter-arguments.
My request relates to a time period that does not include any ongoing criminal investigation I am aware of.
Before publishing, I will verify that no combination of published data and other publicly available information could identify a safeguarding victim.
I have applied the statistical suppression threshold (fewer than 5 = suppress) before deciding what to publish.
I have read the ethics guides on children and intrusion into grief before planning publication.
If publishing names or details of complainants, I have their consent or can demonstrate overriding public interest.
I have noted the 20 working day response deadline and set a reminder.

Copy-paste request template: complaints data

Dear FOI Officer, Under the Freedom of Information Act 2000, I request the following information: 1. The total number of formal complaints received by [AUTHORITY NAME] in each of the financial years [YEAR 1], [YEAR 2], and [YEAR 3]. 2. A breakdown of complaints by category (e.g. by department, service area, or type of complaint) for each of those years. 3. For each year: the number of complaints that were upheld, partially upheld, not upheld, and withdrawn. 4. The number of complaints referred to [the relevant Ombudsman / PHSO / LGO] in each year and the outcomes of those referrals. Please provide the data in a spreadsheet (CSV or Excel). Where any category contains fewer than five individuals, please suppress that cell and indicate that suppression has been applied, rather than providing the raw figure. Please do not include any personal data relating to individual complainants or the subjects of complaints. If any information is withheld, please cite the specific exemption, explain why the public interest test favours non-disclosure, and confirm whether a redacted version can be provided. Yours faithfully, [YOUR NAME]

Dear FOI Officer, Under the Freedom of Information Act 2000, I request the following information: 1. The total number of safeguarding referrals received by [AUTHORITY / LSCB / MASH] in each of the financial years [YEAR 1], [YEAR 2], and [YEAR 3]. 2. A breakdown by broad category of concern (e.g. neglect, physical abuse, emotional abuse, sexual abuse, exploitation) — with statistical suppression applied to any category containing fewer than five cases. 3. The number of referrals that proceeded to a child protection conference, and the number resulting in a child protection plan, in each year. 4. The number of Serious Case Reviews or Child Safeguarding Practice Reviews published by the authority in each year. Please do not include any personal data or information that could identify any child, family, or individual involved in any case. Yours faithfully, [YOUR NAME]

FOI Builder tool

Use our FOI Builder to generate a tailored complaints or safeguarding data request for your specific authority and purpose.

Open FOI Builder

Common exemptions and how to respond

s.40 Personal Data (third parties)

The most common exemption for complaints and safeguarding data. Applies where disclosure would breach the data protection principles — principally because the information relates to identifiable individuals. Counter: confirm you are requesting only aggregate, anonymised statistics with suppression applied. Point out that aggregate data is not personal data if it cannot identify any individual. Request a redacted or suppressed version.

s.31 Law Enforcement

Used where disclosure could prejudice a criminal investigation or prosecution. Most often applied to police complaints data or safeguarding referrals where a criminal investigation is ongoing. Counter: request only completed cases; ask the authority to identify which specific case(s) are under active investigation and provide redacted data for the remainder.

s.41 Information Provided in Confidence

Sometimes claimed for complaint correspondence, particularly patient feedback in NHS contexts. Counter: you are not requesting the content of the complaint — you are requesting statistical data. Aggregate counts of complaints are not themselves provided in confidence.

s.36 Prejudice to Effective Conduct of Public Affairs

Requires a qualified person's reasonable opinion. Sometimes used by councils to protect sensitive internal safeguarding processes. Counter: general trends data about complaint volumes does not disclose deliberative processes or internal governance mechanisms. Ask for the qualified person's opinion in writing.

Common mistakes

Requesting individual case files rather than aggregate statistics — this will always be refused under s.40.
Publishing small-cell data that could identify a safeguarding victim even though the authority disclosed it.
Assuming aggregate statistics are always safe to publish — cross-referencing risks and small populations can re-identify individuals.
Conflating complaints data (formal complaints from service users) with safeguarding referrals — they are different datasets with different legal frameworks.
Forgetting to request data in machine-readable format — a PDF table is hard to analyse and compare across years.
Not exhausting the internal review process before complaining to the ICO — ICO requires internal review first.
Publishing a story about an institution's complaint numbers without contextualising them against the volume of interactions or national benchmarks.

Related guides

Intrusion into Grief

Ethical guidance on reporting that involves the bereaved, victims, and vulnerable people.

Children and Young People

Full ethical guide to reporting involving children — consent, identification, and safeguarding.

FOI Refusals

How to challenge refusals: internal review, ICO complaints, and the First-tier Tribunal.

NHS FOI Requests

Specific guidance for FOI requests to NHS trusts, GP practices, and other health bodies.

Primary sources

Frequently asked questions

Can I request the full case files of safeguarding incidents via FOI?

No. Individual safeguarding case files contain highly sensitive personal data about identifiable individuals — often children or vulnerable adults who are victims of abuse. Disclosure would almost certainly constitute a breach of the UK GDPR and would be exempt under s.40 of the FOIA (personal data of third parties). The correct approach is to request aggregate statistical data: total numbers of cases, case categories, outcomes, and trends — without any information that could identify an individual. Even aggregate data can identify individuals in small populations (see the statistical threshold question below).

What is the statistical disclosure threshold and why does it matter?

Even anonymised data can re-identify individuals if the dataset is small. As a rule of thumb, categories containing fewer than five individuals should be suppressed or merged with neighbouring categories to prevent identification — this is the approach used by NHS Digital and the Office for National Statistics. If an authority produces data with very small cell counts, ask them to apply statistical suppression before disclosure. Some ICO guidance and NHS information governance frameworks specify thresholds explicitly. As a journalist, you should not publish data at a granularity that risks identifying safeguarding victims even if the authority has disclosed it.

What is the s.31 law enforcement exemption and when can authorities use it?

Section 31 of the FOIA exempts information whose disclosure would, or would be likely to, prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the administration of justice. It is a qualified exemption — the public interest must be considered. Authorities sometimes cite s.31 for complaints data if an investigation is ongoing, or for police data that could reveal investigative methodologies. Challenge by: asking whether the specific information you requested (aggregate statistics) relates to a named investigation; and pointing out that general trends data does not disclose any investigative methodology.

How do NHS trusts typically respond to complaints data requests?

NHS trusts are subject to FOIA and most receive substantial complaints. They often hold structured data on complaints received, categorised by clinical area, nature of complaint, and outcome (resolved, upheld, referred to Parliamentary and Health Service Ombudsman). They may claim: s.40 (personal data, even for aggregate data — usually challengeable); s.41 (information provided in confidence, for patient feedback); s.36 (prejudice to effective conduct of public affairs — argue that general statistics do not prejudice operations). The Parliamentary and Health Service Ombudsman also publishes aggregate data on NHS complaint referrals that may be a useful comparison.

What about complaints data from Multi-Academy Trusts (MATs)?

Multi-Academy Trusts are subject to FOIA. Individual academies within a MAT are also subject to FOIA. Requests for complaints data from academies and MATs follow the same principles as other public bodies. Ofsted inspection reports are a useful additional source — they often reference how the school handles complaints. For safeguarding specifically, Ofsted's judgements on safeguarding effectiveness are publicly available and do not require a FOI request.

What ethical obligations do journalists have when reporting safeguarding data?

Extreme care is required. Even when you have obtained aggregate statistics lawfully via FOI, you must consider: whether the level of granularity you intend to publish could identify an individual; whether the framing of the story could cause distress to victims or their families; whether naming a specific institution alongside case numbers creates a risk of individuals being identified; and whether the story genuinely serves the public interest in a way that justifies any potential harm. The NUJ Code and Editors' Code both impose heightened obligations when reporting involves children and vulnerable people. See our guides on reporting on children and intrusion into grief.