Skip to main content

FOI Exemptions by Type — Complete Detail Guide

Every FOIA 2000 exemption from s.21 to s.44 — what it covers, whether it is absolute or qualified, how the public interest test applies, and how journalists can challenge it effectively.

Last reviewed: Next review due:

1. Absolute vs qualified exemptions

The Freedom of Information Act 2000 divides its exemptions into two categories. Absolute exemptions apply automatically when information falls within their defined scope. There is no public interest balancing test — the authority may withhold the information without weighing the arguments for and against disclosure. Qualified exemptionsare different: even if the information falls within the exemption's scope, the authority must also carry out a public interest test under s.2 FOIA and may only withhold if the public interest in maintaining the exemption outweighs the public interest in disclosure.

In practice, the threshold question for any exemption — absolute or qualified — is whether the information actually falls within its scope. Authorities frequently over-apply exemptions. Challenge the application of the exemption before accepting that it is engaged.

Absolute exemptions

No public interest test. Apply when information falls within scope. Key sections: s.21, s.23, s.32, s.34, s.36(1) (certain contexts), s.40(1), s.41, s.44.

Qualified exemptions

Public interest test required. Authority must show the interest in withholding outweighs the interest in disclosure. Includes s.22, s.24–s.31, s.33, s.35, s.36, s.37, s.38, s.39, s.40(2), s.42, s.43.

2. Absolute exemptions in detail

These exemptions require no public interest balancing. However, you can always challenge whether the specific information falls within the exemption's scope.

s.21Information accessible by other meansAbsolute

Covers

Information that is reasonably accessible to the applicant by other means, whether or not under a statutory right.

How to challenge

Challenge if the information is behind a paywall, on a broken link, or is not genuinely findable. If it is not practically accessible, the exemption should not apply.

s.23Information from security bodiesAbsolute

Covers

Information directly or indirectly supplied by, or relating to, bodies specified in the Act: MI5, MI6, GCHQ, the National Crime Agency (in its intelligence function), and others listed in s.23(3).

How to challenge

The connection to a listed security body must be real, not tenuous. Challenge the claimed relationship between the information and the specified body. Neither confirm nor deny may also apply.

s.32Court recordsAbsolute

Covers

Documents served on or by the authority in court proceedings, documents created by a court or tribunal, and documents relating to certain inquiry or arbitration proceedings.

How to challenge

Challenge whether the document truly falls within the narrow statutory definition. A document merely mentioned in court is not the same as a document formally placed before it.

s.34Parliamentary privilegeAbsolute

Covers

Information whose disclosure would infringe parliamentary privilege — principally the privilege of proceedings in Parliament.

How to challenge

Rarely invoked. Challenge whether the information truly engages parliamentary privilege as defined by the courts and the Joint Committee on Parliamentary Privilege.

s.40(1)Personal data of the requestorAbsolute

Covers

Where the information requested is the applicant's own personal data. In this case the appropriate access route is a Subject Access Request under UK GDPR, not FOIA.

How to challenge

Not typically subject to challenge — the correct route is a Subject Access Request rather than an FOI request.

s.41Information provided in confidenceAbsolute

Covers

Information obtained by the authority from another person where disclosure would constitute an actionable breach of confidence.

How to challenge

Challenge whether the information was genuinely provided in confidence (rather than generated internally), and whether disclosure would truly be actionable — both elements must be present.

s.44Statutory prohibitionsAbsolute

Covers

Information whose disclosure is prohibited by any enactment, is incompatible with a European Community obligation, or would constitute contempt of court.

How to challenge

Challenge the specific statutory provision cited. Verify it is still in force, applies to this type of disclosure, and covers this information rather than a broader category.

3. Qualified exemptions and the public interest test

For each of these exemptions the authority must both identify that the exemption is engaged and demonstrate that the public interest in maintaining it outweighs the public interest in disclosure. The authority must provide its public interest reasoning in the refusal notice or within 20 working days under s.17.

s.22Information intended for future publicationQualified

Must identify a specific, genuine intention to publish at a particular future date. Vague plans or indefinite deferrals are not sufficient.

s.24National securityQualified

Covers information not within s.23 where exemption is required for the purpose of safeguarding national security. Specific harm must be identified, not just the category.

s.25Certificates under s.24Qualified

A ministerial certificate under s.24 is conclusive as to national security, but can be challenged before the Tribunal on factual grounds.

s.26DefenceQualified

Prejudice to the defence of the UK or its territories. Historical or operational information where no current harm could arise is harder to withhold.

s.27International relationsQualified

Prejudice to UK relations with foreign states or international organisations. Diplomatic sensitivity must be specific, not merely asserted.

s.28Relations within the UKQualified

Prejudice to relations between the four UK nations. Rarely applied; routine devolved policy coordination does not typically qualify.

s.29EconomyQualified

Prejudice to the economic interests of the UK. A causal link between disclosure and economic harm must be demonstrated.

s.30Investigations and proceedingsQualified

Relates to criminal investigations or proceedings, or confidential sources. Challenge whether proceedings are genuinely ongoing or have concluded.

s.31Law enforcementQualified

Prejudice to prevention or detection of crime, law enforcement, administration of justice, and related functions. Aggregate/anonymised statistics rarely qualify.

s.33Audit functionsQualified

Prejudice to the exercise of audit, inspection, or examination functions by specified bodies (e.g. National Audit Office). Performance data is not automatically exempt.

s.35Formulation of government policyQualified

Relates to formulation of policy, Ministerial communications, and Cabinet minutes. Does not protect policy that has already been decided or operational matters dressed as policy.

s.36Prejudice to conduct of public affairsQualified

Requires a reasonable opinion from a “qualified person” (usually a senior official or Minister). That opinion must address the specific information. Challenge the identity and basis of the qualified person's opinion.

s.37Communications with the Royal FamilyQualified

Covers communications with the Sovereign, heir, or second in line. Challenge if the connection to the specified persons is indirect or peripheral.

s.38Health and safetyQualified

Prejudice to physical or mental health, or safety of any individual. The risk must be specific and realistic, not vague or hypothetical.

s.39Environmental informationQualified

Information that falls within the Environmental Information Regulations 2004 (EIR) should be handled under EIR rather than FOIA. EIR has a stronger presumption in favour of disclosure.

s.40(2)Third-party personal dataQualified

Applies where disclosure would contravene UK GDPR data protection principles. Does not apply to aggregate data, job titles, or role-based records that do not identify individuals.

s.42Legal professional privilegeQualified

Covers information in respect of which LPP could be maintained in legal proceedings. Public interest test applies — and the privilege is not absolute in the FOI context.

s.43Commercial interestsQualified

Trade secrets or information that would prejudice commercial interests of any person. Contract prices, performance metrics, and supplier identities are frequently withheld but often do not meet the threshold.

4. How to challenge an exemption claim

There are three formal stages for challenging a refusal. Each is sequential — you must exhaust internal review before complaining to the ICO, and must receive an ICO Decision Notice before appealing to the Tribunal.

  1. 1

    Internal review

    Write to the public authority requesting an internal review of the refusal. Identify the specific exemption(s) claimed, explain why the information does not fall within scope, and — for qualified exemptions — challenge the public interest reasoning. Use our internal review template. Authorities must complete a review within 20 working days (or 40 in complex cases).

  2. 2

    ICO complaint

    If the internal review upholds the refusal, complain to the Information Commissioner. The ICO can investigate the authority's handling of the request and issue a Decision Notice ordering disclosure if the exemption was not properly applied. Use our ICO complaint template. ICO investigations can take several months.

  3. 3

    First-tier Tribunal (Information Rights)

    If you disagree with the ICO's Decision Notice, you may appeal to the First-tier Tribunal. The Tribunal can substitute its own decision for the ICO's. Further appeals on points of law go to the Upper Tribunal. Tribunal hearings are public and decisions are published on GOV.UK.

5. Common rejection patterns journalists should watch for

  • Citing an exemption without explaining why it applies to the specific information — a bare section number is not a refusal notice.
  • Claiming a qualified exemption without providing any public interest balancing (required by s.17 FOIA — this is a procedural defect).
  • Invoking s.36 without naming the qualified person or the basis of their opinion — frequently challenged successfully at internal review.
  • Applying s.40 to aggregate statistics, job titles, salary bands, or officer-level expenditure data that cannot identify any individual.
  • Claiming s.43 (commercial interests) for an entire contract without identifying which specific parts are genuinely sensitive.
  • Citing s.22 (future publication) without a timetable, commitment, or evidence that publication is genuinely planned.
  • Using s.12 (cost limit) without providing a cost calculation — ask for the calculation and consider narrowing the request.
  • Claiming multiple exemptions simultaneously without specific analysis of each — a scatter-gun approach that often reveals the authority is uncertain of its grounds.

6. The “neither confirm nor deny” (NCND) rule under s.1(1)(a)

Under s.1(1)(a) FOIA, a public authority must normally confirm or deny whether it holds the information you have requested — even if it then goes on to withhold the information under an exemption. Some exemptions permit the authority to issue a “neither confirm nor deny” response, where even acknowledging that the information exists would itself disclose exempt material.

NCND is most commonly used with s.23 (security bodies — where confirming that MI5 holds a file would itself be revealing), s.24 (national security), s.31 (law enforcement — particularly for covert operations), and s.40(2) (third-party personal data — where confirming that a complaint file exists might identify the complainant). Where NCND is applied under a qualified exemption, the authority must also apply a public interest test to the act of confirming or denying.

NCND cannot be used as a blanket policy. Challenge it by asking the authority to explain specifically why confirming or denying would reveal exempt information in the particular circumstances of your request, and which exemption(s) are relied upon for the NCND duty specifically.

7. Checklist for evaluating an exemption claim

  • I have identified the specific exemption(s) cited by section number in the refusal notice.
  • I have determined whether each exemption is absolute or qualified.
  • I have assessed whether the information I requested actually falls within the exemption's scope (not just the general category).
  • For qualified exemptions: I have checked whether the authority provided a public interest test and whether the reasoning is specific.
  • For s.36: I have checked whether the qualified person is identified and whether their opinion addressed the specific information.
  • I have considered whether narrowing or restructuring my request would avoid the exemption entirely.
  • I have searched the ICO's published Decision Notices for rulings on the same exemption by the same or similar authority.
  • I have noted any procedural failures — no public interest test, no cost calculation, no publication timetable — which strengthen an internal review.
  • I have drafted targeted grounds for internal review addressing each exemption separately.

8. Not legal advice

This guide is provided for information and journalistic research purposes only. It does not constitute legal advice, and should not be relied upon as such. The application of FOIA exemptions depends on the specific facts of each request. If you are involved in litigation, a Tribunal appeal, or a matter with significant legal consequences, you should seek advice from a qualified solicitor with experience in information law. UK JournoHub is not a law firm and does not provide legal services.

Frequently asked questions

What is an absolute exemption under FOIA 2000?
An absolute exemption applies automatically whenever the information falls within its defined scope. The public authority does not need to weigh the public interest — it may simply withhold the information. The main absolute exemptions are s.21 (accessible by other means), s.23 (information from security bodies), s.32 (court records), s.34 (parliamentary privilege), s.40(1) (personal data of the requestor), s.41 (information provided in confidence), and s.44 (statutory prohibitions). Even with an absolute exemption you can still challenge whether the information actually falls within the exemption's scope.
How does the public interest test work for qualified exemptions?
Where a qualified exemption is engaged, the authority must carry out a public interest balancing test under s.2 FOIA. It must weigh the public interest in maintaining the exemption against the public interest in disclosure. Disclosure is the default — the authority must identify specific, concrete reasons why withholding serves the public interest more than releasing the information. General assertions that a category of information is sensitive are not sufficient. Factors favouring disclosure typically include accountability for public spending, transparency about decision-making, and the public's right to understand how institutions operate. The authority must state its reasoning in the refusal notice.
Can I appeal or challenge an exemption claim?
Yes. The first step is to request an internal review, which is free and must be completed within 20 working days (or 40 in complex cases). If the internal review upholds the refusal, you can complain to the Information Commissioner's Office (ICO). The ICO can order disclosure if the exemption was not properly applied or the public interest test was conducted incorrectly. If you disagree with the ICO's decision, you can appeal to the First-tier Tribunal (Information Rights). Further appeals on points of law go to the Upper Tribunal and beyond. Templates for both steps are available on UK JournoHub.
What is the neither confirm nor deny (NCND) rule?
Under s.1(1)(a) FOIA, a public authority must confirm or deny whether it holds information. Some exemptions — most notably s.23 (security bodies) and s.24 (national security) — permit an authority to issue a neither confirm nor deny (NCND) response, meaning it will not say whether the information exists at all. NCND is legitimate where confirming or denying would itself reveal exempt information. It cannot be used as a blanket policy. If you receive an NCND response, challenge whether the specific exemption cited actually justifies NCND in the circumstances of your request.
How long does an ICO investigation take?
The ICO aims to resolve straightforward cases within three to six months, but complex cases — particularly those involving national security or large volumes of information — can take considerably longer. There is no statutory deadline by which the ICO must issue a Decision Notice. You should continue to pursue the story through other means while an ICO complaint is pending. The ICO publishes all Decision Notices on its website, which are a useful resource for understanding how specific exemptions have been applied in similar cases.
What is the most commonly claimed FOI exemption?
Section 40 (personal data) is consistently the most frequently cited exemption across all public authorities. It is also frequently misapplied — authorities sometimes use it to withhold aggregate statistics, job titles, salary band data, or role-based information that does not identify any individual. Section 36 (effective conduct of public affairs) and s.43 (commercial interests) are also widely claimed. The ICO has published extensive guidance criticising over-broad applications of all three. Checking the ICO's Decision Notices for the specific authority and exemption is the most effective way to find grounds for challenge.

Related guides

FOIFOI Exemptions OverviewRead →FOIChallenging FOI RefusalsRead →FOIICO Complaint TemplateRead →FOIInternal Review TemplateRead →FOIHow to File an FOI RequestRead →FOIFOI for InvestigationsRead →

Primary sources