Complaining to the ICO: Process & Template

What the ICO does and why it matters

The Information Commissioner’s Office (ICO) is the UK’s independent regulator for information rights. Under Section 50 of the FOIA 2000, anyone who believes a public authority has failed to comply with the Act can complain to the ICO. The ICO investigates the complaint, considers the authority’s position, and — where it finds in the complainant’s favour — issues a legally binding Decision Notice requiring the authority to act. Authorities that fail to comply with a Decision Notice can be cited for contempt of court.

The ICO process is entirely free and available to everyone. Its decisions are published online, creating a public record of the authority’s conduct — a reputational lever that many authorities wish to avoid. For journalists, a Decision Notice ordering disclosure of previously withheld information can also be published as part of the story itself. The ICO is not always fast (cases can take 6-12 months), but it is effective.

The ICO complaint process step by step

When to go to the ICO

• 1After receiving an internal review outcome that upholds the original refusal and you still believe the refusal is wrong.
• 2After 40 working days from requesting an internal review with no outcome received.
• 3Immediately after a missed 20-working-day deadline (no internal review required for delay complaints).
• 4When the authority continues to use the wrong exemption despite your challenge in the internal review.
• 5When the internal review is conducted by the same officer as the original decision and the reasoning is unchanged.
• 6When the authority has broken a Decision Notice — this is contempt of court territory; report it to the ICO immediately.

Red flags — signs your complaint is at risk

• ⚠You have not completed an internal review — for refusal complaints, the ICO will usually require this first.
• ⚠Your complaint is vague — "I think they're hiding something" is not a legal ground; identify the specific exemption you are challenging.
• ⚠You have left it a very long time since the internal review outcome — while there is no hard deadline, delay weakens your complaint.
• ⚠You have accepted a partial disclosure without making clear you still want the withheld parts — be explicit that your complaint covers the withheld information only.
• ⚠You have not attached the key documents — the ICO needs your original request and the authority's response at minimum.
• ⚠You are complaining about information you already received through other means — the ICO may decline to investigate if disclosure would achieve nothing useful.

ICO complaint submission checklist

• I have requested an internal review (or confirmed this is a delay complaint that does not require one).
• I have the internal review outcome (or have waited 40 working days from my review request).
• I have identified each ground of complaint clearly, citing the specific section of the Act.
• I have attached: original request, refusal notice, internal review request, internal review response.
• I have stated the specific outcome I am seeking (disclosure, Decision Notice, etc.).
• I have submitted via ico.org.uk/make-a-complaint and saved the submission reference number.
• I have noted the date of submission and set a calendar check for 3 and 6 months.
• I have saved copies of all materials submitted in case the ICO needs further information.

ICO complaint draft template

Use this as a planning document before completing the ICO’s online form. Replace all [BRACKET] text with your own details. The Grounds section is the most important — be specific and cite section numbers.

ICO COMPLAINT DRAFT
===================
Prepared by: [YOUR NAME]
Date: [DATE]
Submit at: https://ico.org.uk/make-a-complaint/foi-and-eir-complaints/foi-and-eir/

--- SECTION 1: YOUR DETAILS ---
Name: [YOUR FULL NAME]
Email address: [YOUR EMAIL ADDRESS]
Organisation (if applicable): [YOUR PUBLICATION / EMPLOYER]

--- SECTION 2: THE PUBLIC AUTHORITY ---
Authority name: [FULL AUTHORITY NAME]
Authority type: [e.g. Local Council / NHS Trust / Central Government Department / Police Force / University]
Country: [England / Wales / Scotland / Northern Ireland]

--- SECTION 3: YOUR REQUEST ---
Date request sent: [DATE]
Date request received by authority (if different): [DATE OR "same"]
Method of submission: [Email / Post / WhatDoTheyKnow.com]
Request reference (if given by authority): [REF OR "none given"]

Brief description of what you requested:
[2-3 sentences describing the information you asked for — be precise]

--- SECTION 4: THE AUTHORITY'S RESPONSE ---
Date of authority's response: [DATE — or "No response received"]
Type of response:
  [ ] Full refusal (all information withheld)
  [ ] Partial refusal (some information withheld)
  [ ] "Neither confirm nor deny" response
  [ ] No response (missed 20-working-day deadline)

Exemptions cited by the authority (where applicable):
[List each exemption by section number — e.g. s.40(2), s.43(2)]

--- SECTION 5: INTERNAL REVIEW ---
Did you request an internal review?  [ ] Yes  [ ] No
Date internal review requested: [DATE]
Date internal review completed: [DATE — or "Not completed"]
Outcome of internal review:
  [ ] Upheld original decision (full refusal confirmed)
  [ ] Partial uphold (some information now disclosed)
  [ ] No response received within 40 working days
  [ ] Other: [DESCRIBE]

--- SECTION 6: WHY YOU ARE COMPLAINING ---
Set out your grounds clearly. Focus on legal arguments, not just disagreement. Reference section numbers. Examples below:

Ground 1 — [EXEMPTION] is not engaged:
"The authority relied on s.40(2) (personal data) to refuse my request for the total number of formal complaints received in each of the last five years by category. This information consists entirely of aggregate statistics. No individual can be identified from it. Aggregate data cannot be personal data within Article 4(1) UK GDPR. The exemption is therefore not engaged."

Ground 2 — Public interest test not properly conducted:
"Even if s.43(2) (commercial interests) is engaged, the authority's public interest test is defective. It states only that 'commercial confidentiality must be maintained' without identifying any specific harm that would result from disclosure. A boilerplate assertion is not a public interest test. The specific public interest in disclosure — transparency in public procurement — has not been addressed."

Ground 3 — Procedural failure:
"The authority's refusal notice does not comply with s.17 FOIA 2000 because it fails to provide public interest test reasoning for the qualified exemption cited. This is a procedural breach independent of whether the exemption is substantively justified."

Ground 4 — Missed deadline [if applicable]:
"The authority failed to respond within 20 working days of receipt of my request on [DATE]. As of [DATE], no response has been received. This is a breach of s.10 FOIA 2000. I did not receive any extension notice citing a qualified exemption under s.10(3)."

--- SECTION 7: OUTCOME SOUGHT ---
I ask the ICO to:
  [ ] Issue a Decision Notice requiring the authority to disclose the requested information
  [ ] Issue a Decision Notice finding that the authority's refusal was unlawful
  [ ] Issue a Decision Notice requiring the authority to respond (delay complaint)
  [ ] Other: [DESCRIBE]

--- SECTION 8: EVIDENCE TO ATTACH ---
  [ ] Copy of original FOI request (email or letter)
  [ ] Copy of authority's response (refusal notice)
  [ ] Copy of internal review request
  [ ] Copy of authority's internal review response (if received)
  [ ] Any other relevant correspondence

---
NOTE: Submit this complaint online at ico.org.uk/make-a-complaint
You must have completed an internal review (or waited 40+ working days for one) before the ICO will generally investigate a refusal complaint.
For delay complaints (missed 20-working-day deadline), you may go straight to the ICO without an internal review.

For a full copy-to-clipboard version, see the FOI Templates Library (ICO Complaint Draft template).

Common mistakes

• ›Going to the ICO before completing the internal review — the ICO will usually refer you back to the authority first.
• ›Framing the complaint as a political disagreement rather than a legal one — stick to the Act.
• ›Not attaching the key documents — the ICO cannot investigate without seeing the original request and refusal.
• ›Over-explaining — the ICO handles hundreds of complaints; be concise and focused on the legal issues.
• ›Assuming the ICO will be fast — set realistic expectations; 6-12 months is typical for complex cases.
• ›Not appealing the Decision Notice in time — the 28-day appeal window to the First-tier Tribunal is strict.
• ›Giving up if the ICO dismisses the complaint — the First-tier Tribunal conducts a full merits review and often reaches different conclusions from the ICO.

Related guides

Primary sources

• FOIA 2000 s.50 — application to the Commissioner (legislation.gov.uk)
• ICO: Make an FOI or EIR complaint (ico.org.uk)
• ICO: How we handle FOI complaints — guidance (ico.org.uk)
• First-tier Tribunal (Information Rights) — appeals guidance (gov.uk)
• BAILII — First-tier Tribunal (Information Rights) decisions
• WhatDoTheyKnow — track published Decision Notices for specific authorities

Frequently asked questions