Last reviewed: Next review due:
8 min readWhat is the Freedom of Information Act?
The Freedom of Information Act 2000 (FOIA 2000) gives any person the right to request recorded information held by public authorities in England, Wales, and Northern Ireland. Scotland has its own Freedom of Information (Scotland) Act 2002 (FOISA) with near-identical provisions. For environmental information, the Environmental Information Regulations 2004 (EIR) apply instead. The right is broad: it covers any recorded information, in any format, held at the time of the request.
“Any person making a request for information to a public authority is entitled—”
You do not need to be a journalist, a lawyer, or even a UK resident to make an FOI request. You do not need to give reasons. The authority must respond within 20 working days, either by providing the information, confirming it does not hold it, or refusing with a legally valid reason. FOI is one of the most powerful tools available to investigative journalists — but it works best when requests are well-drafted, targeted, and followed up assertively.
When FOI is the right tool
- 1You want spending data — contracts, expenses, procurement — held by a council, NHS trust, or government department.
- 2You are investigating a public institution and need internal reports, audits, or complaints data that is not published.
- 3You are working on a data journalism piece and need structured datasets (crime figures, waiting times, school performance) in machine-readable format.
- 4A public authority has refused a press enquiry but the information is held in recorded form.
- 5You want correspondence between officials relating to a decision that affects the public.
- 6You are tracking a policy or programme and need performance data or monitoring reports.
- 7You suspect a public body has failed in its duties and want internal communications or review documents.
The 8-step FOI process
1
Identify the information you need
Be specific. Vague requests are harder to fulfil and more likely to hit the cost limit. Think about what format the information is likely to be held in — a spreadsheet, a report, a policy document, a set of emails. The more precisely you can describe it, the better.
2
Identify the correct public authority
Check Schedule 1 of the FOIA 2000 or the ICO's authority list. If you are not sure, try WhatDoTheyKnow.com — it lists authorities and their FOI contact details. For NHS bodies, check NHS England's directory. The authority must hold the information at the time of the request.
3
Write your request
A valid request under s.8 FOIA requires: (1) your name, (2) an address for correspondence (email is fine), and (3) a description of the information you want. You do not need to mention the Act by name, but it helps to do so. Specify your preferred format (CSV, Excel, email attachment).
4
Send to the FOI officer
Most authorities have a dedicated FOI or Information Governance team. Send by email if possible — this creates a timestamped record. WhatDoTheyKnow.com sends your request publicly and creates a permanent archive; this is useful for accountability journalism but means your name is published.
5
Wait up to 20 working days
The clock starts the day after the authority receives your request (not when you send it). Weekends and bank holidays do not count. The authority should acknowledge receipt. If you have not heard anything within a few days, send a brief chaser.
6
Review the response
The authority must either: (a) confirm it holds the information and provide it; (b) confirm it does not hold it; or (c) refuse, citing an exemption under the Act. If it refuses, check that it has cited a valid exemption and, for qualified exemptions, provided a public interest test.
7
Request an internal review if refused
If you are unhappy with the response, ask for an internal review. You must do this before the ICO will usually accept a complaint. The review should be completed within 20 working days (up to 40 for complex cases). Do it in writing and set out clearly why you dispute the refusal.
8
Complain to the ICO if still refused
If the internal review fails or is not completed in time, complain to the ICO at ico.org.uk. The ICO can issue Decision Notices requiring disclosure. Its decisions can be appealed to the First-tier Tribunal (Information Rights) and, on points of law, to the Upper Tribunal.
Red flags in an authority’s response
- A refusal that cites an exemption but provides no explanation of why it applies.
- A Section 12 (cost limit) refusal that does not explain how the cost was calculated.
- A "neither confirm nor deny" response (s.1(1)(a)) without any explanation of which exemption justifies it.
- A Section 22 refusal ("intended for future publication") with no publication date or timeline given.
- A Section 40 personal data refusal on clearly anonymised or aggregate data.
- A Section 36 refusal that does not identify the qualified person who gave the reasonable opinion.
- An extension of the deadline beyond 20 working days without citing a qualified exemption and a public interest test in progress.
- A request for unnecessary clarification that is designed to delay rather than genuinely needed.
FOI request checklist
- I have checked that the authority is a public authority under Schedule 1 FOIA 2000 (or FOISA for Scottish bodies).
- I have searched WhatDoTheyKnow.com and the authority's disclosure log for similar requests already answered.
- My request is in writing and includes my name and a correspondence address (email is sufficient).
- I have described the information specifically enough to allow the authority to locate it.
- I have NOT included reasons for my request (not required and can complicate matters).
- I have specified my preferred format (CSV / Excel / email delivery).
- I have noted the date I sent the request and calculated the 20-working-day deadline.
- I have a copy of the sent request saved for my records.
- If the cost limit is a concern, I have narrowed my request to a manageable scope.
- I know which FOI officer / team to contact and have their direct email address.
Draft your FOI request now
Use our free FOI Request Builder to generate a compliant, well-structured request for any UK public authority type in under two minutes.
Common mistakes
- Sending a request to the wrong authority — always verify which body holds the information you need.
- Making the request too broad — wide requests frequently hit the cost limit and are refused under s.12.
- Including your reasons — this is not required and can give authorities ammunition to claim your request is vexatious.
- Not specifying a format preference — always ask for CSV or Excel when you want structured data.
- Missing the internal review window — some authorities impose a 40-working-day limit for submitting a review request.
- Giving up after a refusal — most refusals can be challenged, and many are overturned on internal review or at the ICO.
- Not keeping copies of all correspondence — you will need the full paper trail for an ICO complaint.
- Filing multiple similar requests to the same authority simultaneously — this can be used to justify an aggregation refusal under s.12.
Related guides
FOI Deadlines: The 20 Working-Day Rule
How the clock works, extensions, and what to do when a deadline passes.
FOI Exemptions Explained
Every main exemption from s.21 to s.44 — what they cover and how to challenge them.
Understanding and Challenging Refusals
How to read a refusal notice and push back effectively.
FOI Templates Library
15 ready-to-use request templates for journalists.
Primary sources
- Freedom of Information Act 2000 (legislation.gov.uk)
- Freedom of Information (Scotland) Act 2002 (legislation.gov.uk)
- ICO: Making an FOI request — official guide (ico.org.uk)
- ICO: Section 12 — cost limit guidance (ico.org.uk)
- WhatDoTheyKnow.com — file and track FOI requests publicly
- ICO: Schedule 1 public authorities list (ico.org.uk)
- Environmental Information Regulations 2004 (legislation.gov.uk)
Frequently asked questions
Who can make a Freedom of Information request?
Anyone, anywhere in the world. Section 1 of the Freedom of Information Act 2000 gives "any person" the right to request recorded information held by a public authority. You do not need to be a UK citizen, a journalist, or to give any reason for your request. A child can file an FOI request. An overseas university researcher can file one. The only requirements are that the request is in writing, includes your name and an address for correspondence, and describes the information you want.
What counts as a public authority under FOIA 2000?
Schedule 1 of the Freedom of Information Act 2000 lists the bodies subject to the Act. This includes all UK government departments and their executive agencies, Parliament, local authorities (councils), the NHS, maintained schools, universities, police forces, the armed forces, and thousands of other publicly funded bodies. You can check whether an organisation is a public authority by searching the ICO's list of registered data controllers, or by searching WhatDoTheyKnow.com. Note that private companies providing public services are generally NOT subject to FOI, although they may be subject to the Environmental Information Regulations 2004.
Do I need to give a reason for my FOI request?
No. Section 8 of the FOIA 2000 sets out what a valid request must contain: it must be in writing (including email), give your name, and give an address for correspondence (email counts). You are not required to identify yourself as a journalist, explain why you want the information, or justify your request in any way. Providing reasons can sometimes help an authority understand your request more quickly, but there is no legal requirement to do so, and you should never feel obliged.
What is the cost limit and how does it affect my request?
Under Section 12 of the FOIA 2000, public authorities are not obliged to comply with a request if the cost of doing so would exceed the "appropriate limit" — currently £600 for central government and Parliament, and £450 for all other public authorities. The limit is calculated at a notional rate of £25 per hour (so 24 and 18 hours respectively). If an authority refuses under Section 12, it must explain why and give you the opportunity to narrow your request. You can also ask the authority to search a subset of the records, or break your request into multiple smaller requests.
What happens if the authority misses the 20-working-day deadline?
A missed deadline is a breach of Section 10 of the FOIA 2000. You do not need to wait for an internal review to complain to the ICO about delay — you can go straight to the ICO. In practice, it is usually worth sending a polite chaser first, followed by a formal reminder citing the deadline and threatening an ICO complaint. The ICO takes persistent late responses seriously and can issue enforcement notices against authorities that are serial offenders.
Can I request information in a specific format?
Yes. Under Section 11 of the FOIA 2000, you can express a preference for the format in which you receive information. You can ask for data in CSV or Excel rather than PDF, or request electronic delivery rather than a physical printout. The authority must comply with your preference if it is reasonably practicable to do so. If it cannot meet your preference, it must tell you why. For data journalism, always specify a machine-readable format: a spreadsheet you can analyse is far more valuable than a PDF scan.