Last reviewed: Next review due:
What is an internal review?
An internal review is an authority’s own reconsideration of a decision it has made about an FOI request. It is conducted internally — by a senior officer or team not involved in the original decision — and is the mandatory first step in the complaints process before you can take your case to the Information Commissioner’s Office (ICO). Think of it as the authority marking its own homework, but with formal procedural requirements and the ICO watching over its shoulder.
Internal reviews can be remarkably effective. Authorities know that a poorly reasoned refusal will likely be overturned at the ICO and may be embarrassed in a published Decision Notice. A well-argued internal review request forces the authority to confront the weaknesses in its reasoning and gives it a face-saving route to disclose without having to admit to the ICO that it got it wrong. The ICO’s guidance says internal reviews should be completed within 20 working days, with a maximum of 40 for complex cases.
The internal review process
1
Receive the refusal
The authority issues a refusal notice under s.17 FOIA citing the exemption(s) relied upon, with public interest test reasoning for any qualified exemption. Note the date.
2
Request the review in writing
Write to the FOI or Information Governance team (not a named individual). Cite your original request reference, the date of refusal, and set out your specific grounds for challenging each exemption.
3
Await the review outcome
The authority should respond within 20 working days. It may extend to 40 for complex cases, but must inform you of the reasons and expected date.
4
Review outcome: three possibilities
Uphold (confirmed refusal) → go to ICO. Partial uphold → assess whether to pursue the remaining withheld information at the ICO. Overturned → information disclosed.
5
Escalate to the ICO if needed
If the internal review is not completed within 40 working days, or if the outcome is still a refusal you dispute, complain to the ICO at ico.org.uk/make-a-complaint.
When to request an internal review
- 1After a full refusal where you believe the exemption does not apply or the public interest reasoning is wrong.
- 2After a partial refusal where significant information has been withheld that you believe should be disclosed.
- 3When the refusal notice does not comply with s.17 — missing public interest test, no exemption cited, no appeal rights explained.
- 4When the authority claims it does not hold information that you believe it does hold.
- 5When the authority has applied the wrong exemption (for example, citing s.40 personal data for aggregate statistics).
- 6When the s.36 refusal does not identify the qualified person or the basis of their opinion.
Red flags in the internal review process
- The review is conducted by the same officer who handled the original request — challenge this immediately.
- The review outcome letter repeats the original refusal reasoning verbatim with no new analysis.
- The authority takes longer than 40 working days without explanation — go to the ICO at that point.
- The review introduces a new exemption that was not cited in the original refusal notice — challenge this procedurally.
- The review upholds the original decision without addressing the specific grounds you raised.
- The authority uses the review to offer a narrowed disclosure that does not address the core of your request.
Internal review request checklist
- I have the original request reference and the refusal date noted.
- I have identified each exemption cited and whether it is absolute or qualified.
- I have set out a specific challenge to each exemption (not just a general disagreement).
- For qualified exemptions, I have challenged whether the public interest test was properly conducted.
- For s.36, I have asked who the qualified person is and what their specific opinion was.
- I have requested that the review be conducted by someone not involved in the original decision.
- I have noted the date I sent the review request and calculated 20 and 40 working day dates.
- I have kept a copy of the review request for my ICO complaint file.
Copy-able internal review template
Copy this template and replace all [BRACKET] text with your own details. The most important section is the Grounds — tailor these to the specific exemptions cited in your refusal notice.
[YOUR NAME] [YOUR ADDRESS] [YOUR EMAIL ADDRESS] [DATE] Freedom of Information / Information Governance Team [AUTHORITY NAME] [AUTHORITY ADDRESS] Dear Sir/Madam, Request for Internal Review — FOI Reference: [ORIGINAL REQUEST REFERENCE] I am writing to request an internal review of the authority's response to my Freedom of Information request dated [DATE OF ORIGINAL REQUEST], reference [REF], in which I requested [BRIEF DESCRIPTION — e.g. "the total number of complaints received by the Council in each of the last five financial years, broken down by complaint category"]. The authority's response dated [DATE OF RESPONSE] refused my request [in full / in part] on the basis of [EXEMPTION(S) CITED — e.g. "Section 40(2) (personal data) and Section 43(2) (commercial interests)"]. GROUNDS FOR REVIEW [GROUND 1 — challenge the application of the first exemption] Section [SECTION]: [EXEMPTION NAME] The authority's reliance on this exemption is not made out for the following reasons: [Set out your specific argument. Examples:] "The information I requested consists of aggregate statistics recording the total number of complaints per year by category. This information does not and cannot identify any living individual. It is therefore not 'personal data' within the meaning of Article 4(1) of the UK GDPR, and Section 40(2) of the FOIA 2000 is not engaged." "Even if Section 43(2) is engaged, the public interest test favours disclosure. The authority is spending public money under contracts with [SUPPLIER]. There is a clear and specific public interest in transparency about how public funds are spent and how contractors perform. The authority has not identified any specific commercial harm that would result from disclosure." "Section 36 requires a 'reasonable opinion' from a 'qualified person.' The refusal notice does not identify who provided this opinion, when it was given, or what specific prejudice to the effective conduct of public affairs was envisaged. An opinion that is not identified and not explained cannot be 'reasonable' within the meaning of the Act." [GROUND 2 — challenge the public interest test if applicable] [If the exemption is qualified]: The public interest test was not properly conducted because [REASON — e.g. "the authority failed to identify any specific harm that disclosure would cause" / "the authority's reasoning is generic and does not address the specific information requested"]. [GROUND 3 — procedural failure, if applicable] The refusal notice does not comply with Section 17 of the Act because [REASON — e.g. "it does not provide public interest test reasoning for the qualified exemption relied upon" / "it does not advise me of my right to request an internal review"]. OUTCOME SOUGHT I request that the authority: 1. Provide the withheld information in full, OR 2. Provide a revised, legally compliant refusal notice that properly addresses each of the above grounds. I request that the review be conducted by a person who was not involved in handling the original request. I look forward to the outcome of the internal review within 20 working days. If the review cannot be completed within 20 working days, please advise me of the reasons and the expected completion date. I note that the ICO expects all internal reviews to be completed within 40 working days at the latest. Yours faithfully, [YOUR NAME] [YOUR PUBLICATION OR ORGANISATION, if applicable]
For a more detailed template and a copy-to-clipboard button, see the FOI Templates Library (Internal Review Request template).
Build a targeted appeal automatically
Our FOI Appeal Builder guides you through each exemption and generates a ready-to-send internal review request with the correct legal arguments for the specific exemptions cited in your refusal.
Common mistakes
- Writing a review request that just says "I disagree" — you must identify why the exemption is wrong.
- Sending the review to the wrong team or the wrong authority entirely.
- Requesting an internal review for a missed deadline — go straight to the ICO for delay issues.
- Not keeping a copy of the review request — you will need it for the ICO complaint.
- Assuming the internal review will be objective — it is the authority reviewing itself, which is why the ICO route exists.
- Not setting a calendar reminder — if the authority does not respond within 40 working days, go to the ICO.
- Narrowing the request informally instead of making a formal review request — narrowing waives your right to challenge the original refusal.
Related guides
Understanding FOI Refusals
How to read a refusal notice and identify grounds for challenge.
FOI Exemptions Explained
Every exemption from s.12 to s.44 — how to challenge each one.
ICO Complaint Guide
What happens after a failed internal review — escalating to the ICO.
FOI Templates Library
Full template library including the Internal Review and Refusal Challenge templates.
Primary sources
- FOIA 2000 s.17 — refusal of request (legislation.gov.uk)
- FOIA 2000 s.50 — application to the Commissioner (legislation.gov.uk)
- ICO: Internal reviews — guidance for public authorities and applicants (ico.org.uk)
- ICO: Complain to the ICO about a public authority (ico.org.uk)
- ICO Decision Notices — search by authority or exemption (ico.org.uk)
- WhatDoTheyKnow — file and track internal reviews publicly
Frequently asked questions
Is an internal review required before I can complain to the ICO?
In most cases, yes. The ICO expects you to have requested an internal review before it will investigate a complaint about a refusal. However, there is an important exception: if your complaint is about a missed deadline (the authority failed to respond within 20 working days), you can complain to the ICO directly without waiting for an internal review. The ICO treats delay and refusal as different issues — delay breaches are often faster to investigate.
How long does an internal review take?
The ICO's guidance says that authorities should complete internal reviews within 20 working days of receiving the review request, with up to 40 working days permitted for genuinely complex cases. There is no hard statutory time limit on internal reviews in the FOIA 2000 itself — but if an authority takes longer than 40 working days without completing the review, the ICO will generally consider a complaint at that point, treating the delay as equivalent to a refusal. Always note the date you request the review and calculate both the 20 and 40 working day dates.
What outcomes can an internal review produce?
An internal review can result in three outcomes: (1) uphold — the authority confirms the original decision to refuse, leaving you with the ICO complaint route; (2) partial uphold — the authority agrees to release some but not all of the withheld information; or (3) overturn — the authority agrees to provide the information in full. In some cases, the review may also result in a new, better-reasoned refusal notice that properly identifies the exemption and public interest reasoning, which gives you a clearer basis for an ICO complaint if you remain unhappy.
Should I address the internal review to a specific person?
Address it to the FOI or Information Governance team, not to a named individual — staff change. In your letter, explicitly request that the review be conducted by someone who was not involved in the original decision. The ICO's guidance says that internal reviews should be conducted by a senior officer not involved in the first decision. If the original response was signed by the Chief Executive, you may want to note that the review should be conducted by a legally qualified officer or by an independent reviewer.
Can I request an internal review if the authority said it does not hold the information?
Yes. If you believe the authority does hold the information but claimed otherwise, you can request a review of that "does not hold" response. In your review request, explain why you believe the information is held — for example, because similar information has been disclosed before, because the authority's own published documents reference the records you are seeking, or because a whistleblower has told you the records exist. The ICO can also require the authority to search more thoroughly for records it claims not to hold.