Last reviewed: Next review due:
Absolute vs qualified exemptions
The Freedom of Information Act 2000 contains two categories of exemptions. Absolute exemptions apply automatically when information falls within their scope — there is no public interest test and the authority does not have to weigh up the arguments for disclosure. Qualified exemptions also require the authority to apply a public interest balancing test: the information may only be withheld if the public interest in maintaining the exemption outweighs the public interest in disclosure.
In both cases, the threshold question is whether the information actually falls within the exemption at all. Authorities frequently over-apply exemptions — claiming, for example, that aggregate statistics constitute personal data (they do not), or that any correspondence with a contractor is commercially sensitive (it is not). Always challenge the application of the exemption before conceding that it is engaged.
Absolute exemptions
No public interest test. Apply when the information falls within scope. Key sections: s.21, s.23, s.32, s.34, s.40 (partly), s.41, s.44.
Qualified exemptions
Public interest test required. Authority must show the interest in withholding outweighs the interest in disclosure. Includes s.22, s.24–s.31, s.33, s.35–s.38, s.42, s.43.
When understanding exemptions is critical
- 1When you receive a refusal — you need to know whether the exemption cited is absolute or qualified, and what the authority must prove.
- 2When drafting your internal review request — identifying the specific weakness in the exemption application is the most effective challenge.
- 3When writing your ICO complaint — the ICO considers whether the exemption was properly applied and whether the public interest test was conducted correctly.
- 4When deciding whether to escalate — some absolute exemptions are very difficult to challenge; qualified exemptions are often more vulnerable.
- 5When narrowing your request — knowing which type of data triggers which exemption helps you draft requests that avoid the problem.
Red flags in exemption refusals
- The authority cites an exemption without explaining why it applies to the specific information requested.
- A qualified exemption is cited but no public interest test reasoning is provided (required by s.17).
- Section 36 is cited but the identity of the qualified person and the basis of their opinion is not given.
- Section 40 is applied to clearly aggregate, anonymised, or role-based data.
- Section 12 is cited but no cost calculation or estimate is provided.
- Section 22 is cited with no publication timetable or commitment.
- Multiple exemptions are cited as a belt-and-braces approach with no specific analysis of each.
All main exemptions — quick reference
Covers
Compliance would cost more than £450 (most authorities) or £600 (central government).
Common abuse
Refusing without explaining the calculation, or refusing a narrowed version of a request.
How to challenge
Ask for the cost calculation. Offer to narrow the scope. Consider splitting the request into smaller parts over time.
Covers
Request is manifestly unreasonable or substantially similar to one already answered.
Common abuse
Applying it to any persistent journalist or requestor who asks difficult questions.
How to challenge
Demonstrate the public interest. Point out that persistence in pursuing a legitimate story is not vexatiousness. Request the ICO review the authority's application.
Covers
Information that is reasonably accessible to the applicant by other means.
Common abuse
Pointing to information that is technically published but impossible to find, or behind a paywall.
How to challenge
If the information is not genuinely accessible (dead link, paywall, out of date), say so and ask the authority to provide the specific document.
Covers
Information held with a view to publication at some future date.
Common abuse
No publication timetable given, vague plans, or "planned publication" that never materialises.
How to challenge
Ask for the specific publication date or timeframe. If none can be given, the exemption is harder to sustain. A public interest test applies.
Covers
Information obtained in the course of ongoing research intended for future publication.
Common abuse
Extending indefinitely under the guise of "ongoing" research.
How to challenge
Challenge whether the research is genuinely ongoing and whether a publication date exists. Public interest test applies.
Covers
Information directly or indirectly supplied by, or relating to, specified security bodies (MI5, MI6, GCHQ, etc.).
Common abuse
Claiming information "relates to" security bodies when the connection is tenuous.
How to challenge
Limited — this is an absolute exemption. However, challenge the connection to the listed bodies if it is not clear. Neither confirm nor deny may also apply.
Covers
Exempting information not covered by s.23 where required for national security purposes.
Common abuse
Vague claims that disclosure might affect national security without specific reasoning.
How to challenge
A public interest test applies. Challenge whether the specific harm is identified and proportionate.
Covers
Information that would prejudice defence of the UK or British Overseas Territories.
Common abuse
Applying to historical or operational information where no current harm could arise.
How to challenge
Public interest test applies. Challenge whether disclosure of the specific information would cause actual prejudice.
Covers
Information that could prejudice UK relations with foreign governments or international organisations.
Common abuse
Claiming diplomatic sensitivity for matters of purely domestic interest.
How to challenge
Public interest test applies. Challenge the specificity of the harm — vague assertions of diplomatic sensitivity are not sufficient.
Covers
Information that would prejudice relations between the four UK nations.
Common abuse
Rarely used; applying to routine policy coordination that would not genuinely harm inter-governmental relations.
How to challenge
Public interest test applies. Challenge whether the information relates to genuine inter-governmental relations or merely to devolved policy.
Covers
Information that would prejudice the economic interests of the UK or any part of it.
Common abuse
Applying to financial data that could embarrass the government but would not harm the economy.
How to challenge
Public interest test applies. Challenge the causal link between disclosure and economic harm.
Covers
Information relating to criminal investigations or proceedings, or information obtained from confidential sources.
Common abuse
Refusing information about concluded investigations where no live proceedings exist.
How to challenge
Public interest test applies for s.30(1). Challenge whether proceedings are truly ongoing and whether the specific information could prejudice them.
Covers
Information that would prejudice prevention or detection of crime, law enforcement, administration of justice, etc.
Common abuse
Routine police statistics or concluded enforcement actions routinely refused.
How to challenge
Public interest test applies. Challenge whether aggregate/anonymised data could genuinely prejudice law enforcement.
Covers
Documents placed in court proceedings, documents created by a court, or documents relating to court or inquiry proceedings.
Common abuse
Attempting to use it for documents that were merely mentioned in court rather than formally placed before it.
How to challenge
Limited — absolute exemption. Challenge whether the document truly falls within the narrow definition of a court record.
Covers
Information that would prejudice the exercise of audit functions (e.g. NAO, Audit Commission equivalent bodies).
Common abuse
Blanket refusal of performance or inspection data.
How to challenge
Public interest test applies. Challenge whether the specific information would genuinely prejudice audit functions.
Covers
Information disclosure of which would infringe Parliamentary privilege.
Common abuse
Rare; applies mainly to Commons/Lords proceedings and correspondence with Members.
How to challenge
Limited — absolute exemption. Challenge whether the information truly engages parliamentary privilege.
Covers
Information relating to the formulation or development of government policy, Ministerial communications, and Cabinet minutes.
Common abuse
Routinely applied to policy that has already been decided, or to operational matters dressed up as policy.
How to challenge
Public interest test applies — and the ICO has held it does not automatically follow that policy advice should be withheld. Challenge whether policy is genuinely still being formulated.
Covers
Information whose disclosure would, or would be likely to, inhibit the free and frank exchange of views or provision of advice.
Common abuse
Applied without proper sign-off by the qualified person, or based on a boilerplate opinion not tied to the specific information.
How to challenge
Requires a "reasonable opinion" from a "qualified person" (usually a senior official or Minister). Challenge who gave the opinion and whether it addressed the specific information. Public interest test applies.
Covers
Information relating to communications with the Sovereign, heir, or second in line to the throne.
Common abuse
Expanded beyond genuine royal communications to ministerial papers that merely mention royalty.
How to challenge
Public interest test applies. Challenge the direct connection to the exempted communications.
Covers
Information that could endanger physical or mental health, or the safety of any individual.
Common abuse
Applying to generic public information on the basis of vague harm to unspecified individuals.
How to challenge
Public interest test applies. Challenge the specific and realistic nature of the identified risk.
Covers
Information that is personal data of a third party (absolute for data that would breach data protection principles). Partly qualified where the data is of the requester.
Common abuse
Applied to aggregate/anonymised data, job titles, or expenditure records that cannot identify any individual.
How to challenge
Challenge whether the data is truly personal data. Anonymised or aggregate statistics are not personal data. Job titles and pay scales of senior officials are often not exempt.
Covers
Information provided to the authority in confidence, where disclosure would be an actionable breach of confidence.
Common abuse
Applying to information the authority itself generated, or where no true confidence obligation exists.
How to challenge
Challenge whether the information was genuinely provided in confidence (not generated internally). Challenge whether disclosure would truly be actionable.
Covers
Information in respect of which a claim to legal professional privilege (LPP) could be maintained in legal proceedings.
Common abuse
Applying to legal advice obtained years ago, or to general policy positions informed by legal advice.
How to challenge
Public interest test applies. Challenge whether the specific information truly constitutes LPP. Disclosure of legal risk assessments, as distinct from advice, may be different.
Covers
Trade secrets, or information whose disclosure would prejudice the commercial interests of any person.
Common abuse
Blanket refusal of all contract information including prices, performance metrics, and supplier names.
How to challenge
Public interest test applies. Challenge whether a real, specific commercial prejudice has been identified. Public contract value and supplier identity are often not legitimately exempt.
Covers
Information whose disclosure is prohibited by any UK enactment, Community obligation, or court order.
Common abuse
Citing outdated or inapplicable statutory provisions.
How to challenge
Challenge the specific statutory provision cited and whether it truly prohibits disclosure of this information to this requester in this context.
Exemption challenge checklist
- I have identified the specific exemption(s) cited in the refusal notice (by section number).
- I have determined whether each exemption is absolute or qualified.
- For qualified exemptions: I have checked whether the authority provided a public interest test.
- For s.36: I have checked that the "qualified person" and the basis of their opinion are identified.
- I have assessed whether the information actually falls within the exemption's scope (rather than assuming it does).
- I have considered whether narrowing my request would avoid the exemption entirely.
- I have drafted specific grounds for my internal review challenging each exemption applied.
- I have noted any procedural failures in the refusal notice (e.g. no public interest test provided for a qualified exemption).
Challenge a refusal with our Appeal Builder
Our FOI Appeal Builder helps you draft an internal review request that targets the specific exemption — s.12, s.40, s.43, or any other — with the right arguments and legal citations.
Common mistakes
- Assuming an absolute exemption cannot be challenged — you can always challenge whether the information falls within scope.
- Accepting a qualified exemption refusal without checking whether a proper public interest test was conducted.
- Failing to challenge s.36 refusals when no qualified person is identified — this is a procedural defect that often succeeds at internal review.
- Treating any mention of personal data as a valid s.40 refusal — aggregate data, job titles, and role-based records are often not personal data.
- Conceding s.43 claims without asking for a specific analysis of the commercial harm — contract prices and performance data are often publicly available through procurement transparency rules.
- Not reading the ICO Decision Notices on the specific exemption before writing your challenge — the ICO publishes hundreds of notices that show how exemptions should and should not be applied.
Related guides
Primary sources
- Freedom of Information Act 2000 — Part II Exempt Information (legislation.gov.uk)
- ICO: Exemptions guidance hub (ico.org.uk)
- ICO: Public interest test guidance (ico.org.uk)
- BAILII — FOI Decision Notices and Tribunal decisions
- ICO Decision Notices search (ico.org.uk)
- WhatDoTheyKnow — search how other requesters challenged the same exemption