Last reviewed: Next review due:
FOI as an investigative tool, not the investigation
A common mistake among journalists new to FOI is treating it as an investigation in itself: file a request, wait for the response, write the story. That approach produces thin, easily-challenged stories. The strongest investigative journalism uses FOI to confirm what other sources already suggest, to obtain specific documents that prove the story, or to establish a dataset that enables comparison across authorities.
The multi-source model — combining open data, OSINT, sources, interviews, and FOI — produces more robust stories because each source corroborates the others. If an authority tells you that data does not exist, but an FOI response from two years earlier shows it was collected, that contradiction is itself a story.
This guide sets out an eight-phase investigative workflow that places FOI in its proper context alongside the other tools available to a UK investigative journalist.
When FOI is most valuable in an investigation
- 1When you need specific documents — emails, minutes, contracts — that are not available through open data.
- 2When you want to establish what officials knew and when — FOI can surface internal correspondence that shows awareness of a problem.
- 3When open data gives you the national picture but you need the local granularity that only the authority holds.
- 4When you are filing to multiple authorities to build a comparative dataset — FOI enables the ranking and league table that open data alone cannot provide.
- 5When you need to put a specific number on something — the precise cost, the exact number of incidents — that an authority has not voluntarily published.
- 6When you want to demonstrate that an authority is refusing to disclose information that the public has a right to — the refusal and the appeal process become part of the story.
Red flags in FOI-based investigations
- Filing via WhatDoTheyKnow for a sensitive investigation — your request and topic are immediately public.
- Building a story entirely on a single FOI disclosure without corroborating it from another source.
- Not anticipating the 20-working-day wait — FOI timelines rarely fit news cycles without planning.
- Filing broad requests that attract s.12 cost-limit refusals, causing months of delay on a time-sensitive investigation.
- Not obtaining legal review before publishing allegations of dishonesty or financial impropriety that emerge from FOI data.
- Failing to give subjects a proper right of reply — particularly important when FOI data is the primary evidence.
- Storing whistleblower contact details in the same folder as your FOI correspondence — keep source materials strictly separate.
The eight-phase investigative workflow
1
Establish the hypothesis
Every investigation starts with a question: is there evidence that X has happened? Define your hypothesis clearly before choosing your data strategy. A vague investigation produces vague FOI requests that attract vague refusals. A specific hypothesis — "Has [authority] been paying contractors linked to board members?" — allows you to design targeted, effective requests.
2
Open data and OSINT first
Before filing any FOI, exhaust open data sources. Companies House (free), Land Registry (free price paid and overseas ownership data), Charity Commission (free accounts), IPSA (MP expenses), ONS, NHS Digital, data.police.uk, and BAILII judgments may give you most of what you need without the 20-working-day wait or the risk of alerting your subject. Wayback Machine and Aleph extend your reach internationally.
3
Develop sources
Whistleblowers, former employees, and on-the-record sources provide context, detail, and the interpretive frame that transforms raw data into a story. Approach sources before relying on FOI — they may be able to point you to specific documents or confirm what to look for. Protect your sources rigorously: do not store their details alongside FOI correspondence, and do not let your FOI requests reveal what your source knew.
4
Design your FOI strategy
Map what you still need. Design FOI requests to fill specific gaps: documents confirming a decision, expenditure data at a granularity not in published datasets, or correspondence between named officials. Start broad (request the dataset), narrow on refusal (reduce date range or scope), and anticipate the appeal process in your timeline. For multi-authority projects, decide whether to use WDTK (public, fast to file in bulk) or direct email (private, essential for sensitive investigations).
5
Layer your data sources
The most powerful investigations combine multiple sources that corroborate each other. A council's own published spending data, combined with FOI disclosure of internal emails, combined with Companies House to identify the directors of the contractor, combined with Land Registry to identify connected property ownership — these layers create a story that is hard to deny. Document each source independently so each can stand alone if others are challenged.
6
Preserve evidence and chain of custody
For every disclosure: save the original PDF immediately on receipt, extract key data to a plain-text file, screenshot the WhatDoTheyKnow disclosure log if applicable, and note the authority name, reference number, and response date. Back up to two locations. For leaked documents: photograph or scan originals where possible, note when and how you received them, and keep them in a secure, encrypted folder. Do not modify source documents.
7
Legal review and right of reply
Before publication, have a media lawyer review any story with defamation risk — allegations of dishonesty, financial impropriety, or serious misconduct against named individuals. Give all subjects named in a serious allegation a meaningful right of reply: state the allegation clearly, provide evidence you intend to rely on, and give a reasonable deadline (usually five to ten working days for a complex investigation). Document all responses and non-responses. See our right-of-reply guide for the full process.
8
Publication and post-publication
Publish with full source citations — cite each FOI response by authority, reference number, and date. Keep your evidence file for at least three years (the potential defamation limitation period). Monitor for post-publication responses from the authority or subjects. If new FOI disclosures emerge from the same investigation, file follow-up requests to pursue the next angle.
Cross-jurisdictional FOI: filing to multiple authorities
One of the most effective investigative techniques is sending an identical request to every authority of a given type — all 43 police forces, all 215 NHS trusts, all 317 English councils. The resulting dataset enables you to rank, compare, and find outliers. Outliers are stories.
What to standardise
- The exact wording of your request (identical for all authorities)
- The date range and data fields requested
- The format requested (Excel or CSV)
- Your tracking ID system (one row per authority)
What to expect
- Different response formats — you will need to clean and normalise data
- Some authorities refusing while others disclose
- Varying reference number formats across authorities
- Deadlines spread across several weeks as acks come in at different times
For large multi-authority projects, consider WhatDoTheyKnow Pro for bulk filing with a privacy period, or use direct email filing to protect the investigation until you are ready to publish.
Investigative FOI checklist
- I have a clear investigative hypothesis before designing any FOI requests.
- I have exhausted open data sources (ONS, Companies House, Land Registry, NHS Digital, data.police.uk) before filing.
- I have decided whether to file via WhatDoTheyKnow or directly, based on whether exclusivity matters.
- I have a tracker for all active requests in this investigation, with deadlines and status.
- I have designed requests for specific defined data, not open-ended document fishing exercises.
- Source materials and FOI correspondence are stored separately and backed up.
- I have budgeted adequate time for potential refusals, internal reviews, and ICO complaints.
- Before publication: I have obtained legal review for any story with defamation risk.
- I have given all named subjects a proper right of reply with adequate time to respond.
- I have cited all FOI responses in the published story by authority, reference number, and date.
Tools for investigative FOI
Use our FOI Request Builder to generate targeted requests, and our Risk Register to track legal and editorial risks across a complex investigation.
Common mistakes in investigative FOI
- Filing too early — FOI requests can alert subjects and trigger document retention reviews or pre-emptive PR.
- Treating a single FOI disclosure as sufficient evidence for a serious allegation without corroborating it.
- Not building the right-of-reply process into the investigation timeline — leaving inadequate time before publication.
- Mixing source contact details with FOI documents — a data breach risk and a source protection failure.
- Not citing FOI responses fully in the published story — weakens credibility and prevents verification.
- Abandoning a refused request without considering the internal review and ICO appeal route.
- Failing to file follow-up requests when a disclosure reveals new angles — the best investigations generate their own leads.
Related guides
Primary sources
Frequently asked questions
Should FOI be the first thing I do when starting an investigation?
Generally no. FOI requests are slow (minimum 20 working days), may alert subjects to your investigation, and are public on WhatDoTheyKnow. Start with open data, OSINT, Companies House, Land Registry, and BAILII. Interview sources and whistleblowers. Use FOI to fill specific gaps that open data cannot provide, or to obtain documents that confirm what you already suspect. Think of FOI as confirmation and detail, not discovery.
How do I protect a whistleblower source while using FOI?
FOI requests are separate from source protection — the two are complementary, not contradictory. Keep your FOI requests vague enough that they do not betray your source's specific knowledge. If a source tells you about a specific document, do not quote the document description verbatim in your FOI request — paraphrase it so the authority cannot identify your source by what they knew. Never store source contact details alongside FOI correspondence.
How do I budget for FOI-based investigations?
Most FOI requests are free. However, some require fees for photocopying (rare) or charge under s.9 for disbursements. EIR requests under the Environmental Information Regulations can involve charges. More practically, budget time: a refused request with internal review and ICO complaint can take 6-12 months to resolve. Budget for legal read of the final story, right-of-reply process, and potential libel insurance for high-risk investigations.
When should I bring in a media lawyer during an FOI investigation?
At two stages: before publication (for stories with defamation risk based on what the FOI data shows), and if you receive a pre-action legal letter during the investigation. For the investigation itself, a lawyer is not usually needed for filing requests. However, if an authority threatens legal action to prevent publication of a disclosure, or if the data reveals serious criminal conduct by named individuals, take legal advice before publishing.
What is cross-jurisdictional FOI and how do I manage it?
Cross-jurisdictional FOI means filing the same request to multiple public authorities — for example, all 43 police forces, all NHS trusts, or all district councils. This creates a dataset that enables comparison and ranking. The management challenge is volume: 43 authorities with different deadlines, reference numbers, and response formats. Use a tracker spreadsheet, standardise your request text, and allow time to clean and analyse the aggregated dataset before publication.