Universities and FOI — The Distinct Process | UK JournoHub

Last reviewed: 13 June 2026Next review due: 13 December 2026

Why universities are subject to FOIA

Schedule 1 Part II of the Freedom of Information Act 2000 lists “publicly funded educational institutions” as public authorities. This covers every university and higher education institution in England, Wales, and Northern Ireland that receives public funding from the relevant funding body — historically the Higher Education Funding Council for England (HEFCE) and now the Office for Students (OfS), with equivalent bodies in the devolved nations.

The Higher Education Statistics Agency (HESA) defines which bodies fall within this category through its data collection agreements. In practice, every institution required to register data with HESA and regulated by the OfS (or its devolved equivalents) is a public authority for FOI purposes. This includes the Russell Group, post-1992 universities, specialist arts and conservatoire institutions, and most further education colleges with higher education provision.

FOIA has applied to universities since January 2005. Despite this two-decade obligation, many universities continue to treat transparency as optional, relying on a range of exemptions more aggressively than central government departments. Understanding the specific exemptions universities use — and how to challenge them — is essential for effective FOI work in the higher education sector.

What is and is not covered

FOIA covers recorded information held by the university in any form. This is a broad category. The following types of information are routinely disclosable and should be requested directly:

Governance documents: minutes of the Board of Governors, Senate, and key committees; terms of reference; conflict of interest registers.
Contracts with external parties: value, supplier identity, and performance terms for contracts above the transparency threshold, including catering, estates, and IT contracts.
Executive remuneration: vice-chancellor total pay package including bonuses, pension, and expenses; pay ratio with median staff.
Student complaint statistics: volume by category, outcome, and year — not identifiable case files.
Staff redundancy data: numbers and cost by year and faculty.
Procurement decisions: tenders received, evaluation criteria, and award rationale for significant contracts.

The following categories are more complex or may be legitimately withheld in whole or in part:

Individual academic correspondence: likely exempt under s.40 (personal data) or s.36 (effective conduct of public affairs) if it concerns teaching, research opinions, or peer review.
Raw research datasets: may be withheld under s.22A (ongoing research intended for future publication) or s.43 (commercial interests where industry-sponsored).
Student-level data: routinely and correctly withheld under s.40 as personal data — request aggregate statistics instead.
Ongoing disciplinary or misconduct investigations: properly withheld under s.40 and s.30 while proceedings are live, but aggregate outcome data should be disclosed.

Common refusal patterns specific to universities

Universities use a recognisable set of exemptions. Knowing these in advance allows you to draft requests that anticipate refusals and to challenge them effectively.

S.43 — Commercial interests

Frequently used to withhold industry-sponsored research agreements, technology transfer contracts, and spin-out company arrangements. Universities argue that disclosure would prejudice the commercial interests of the sponsoring company or the university's ability to attract future research income. Challenge by arguing that the public interest in understanding how research priorities are set by commercial sponsors outweighs the commercial interest, particularly where the research is publicly funded or affects public health or safety.

S.27 — International relations

Used occasionally to withhold information about partnerships with foreign universities, particularly state-linked institutions. S.27 is a qualified exemption requiring a specific prejudice to UK international relations or the interests of the UK abroad. Vague assertions that disclosure might “damage the relationship” are insufficient. Challenge by asking for specific evidence of the harm and applying the public interest test, which strongly favours disclosure of governance arrangements with foreign state-linked entities.

S.40 — Personal data of individual academics

S.40 is an absolute exemption for third-party personal data. Universities often apply it too broadly — to aggregate salary data, complaint counts, or anonymised case outcomes — when the information does not actually identify any individual. The key question is whether the information, alone or in combination, could identify a living individual. Aggregate statistics cannot. Redacted correspondence, with identifying details removed, may also be disclosable. Always challenge s.40 refusals applied to aggregated or anonymised data.

S.22A — Ongoing research

S.22A was introduced specifically for higher education and covers information obtained in the course of research intended for future publication, where disclosure before publication would be likely to prejudice the research or the interests of a researcher. This is a qualified exemption with a public interest test. Challenge by asking whether a genuine publication is planned, what the timeline is, and whether the specific information requested (rather than the whole dataset) would truly prejudice the research if disclosed now.

The charity status complexity

Most UK universities are also registered charities. This creates a parallel transparency regime that can supplement — or complicate — your FOI work.

As charities, universities must file annual accounts and a trustees' annual report with the Charity Commission (in England and Wales) or OSCR (in Scotland). These are publicly available and often contain financial detail — including executive pay, total expenditure, and major income sources — that a university might resist disclosing under FOIA. Always check the charity accounts before filing a request: if the data is already published, a s.21 (accessible by other means) response is likely.

Charity status also means the Charity Commission has oversight of the university's governance. If you believe a university has misused charitable funds or acted outside its charitable purposes, the Charity Commission is a regulatory route separate from FOI. The Commission can investigate and require disclosure of documents that would not be accessible under FOIA alone.

Universities sometimes argue that their commercial activities — such as research commercialisation, spin-out companies, or commercial lettings — are not charitable activities and are therefore outside the scope of FOIA. This argument has not been accepted by the ICO: if the information is held by the university, it is held by the public authority regardless of which activity generated it.

JISC framework and best practice disclosure logs

JISC (formerly the Joint Information Systems Committee) has published guidance for universities on managing FOI compliance. Its model publication scheme and disclosure log template are widely used across the sector. A well-run university will maintain a regularly updated disclosure log — a public record of all information disclosed in response to FOI requests — and a publication scheme setting out what it proactively publishes.

Before filing a request, check whether the university operates a disclosure log. Many publish these on their website or contribute to the WhatDoTheyKnow platform. If a similar request has been answered before, the information should be available immediately. If a similar request was refused, you can see the grounds used and anticipate the likely challenge.

The ICO's model publication scheme requires all public authorities — including universities — to proactively publish information in seven defined classes: who the organisation is, what it spends and how, what its priorities are, how it makes decisions, its policies and procedures, lists and registers, and the services it provides. If a university fails to maintain its publication scheme, that is itself a breach of FOIA that can be reported to the ICO.

What to do when a university refuses

A refusal triggers a three-stage challenge process. Each stage has its own timeline and requirements.

1
Internal review
Request an internal review in writing within 40 working days of the refusal. Address it to the university's FOI officer or data protection officer. State clearly which exemption you are challenging and why you believe the public interest test favours disclosure. The university should complete the internal review within 20 working days (or 40 for complex cases). Use our internal review template.
2
ICO complaint
If the internal review upholds the refusal (or the university fails to conduct one within the required period), complain to the Information Commissioner's Office. The ICO investigates free of charge and can issue a Decision Notice requiring disclosure. Scottish universities are subject to the Scottish Information Commissioner rather than the ICO. Use our ICO complaint template.
3
First-tier Tribunal
Either the requester or the public authority can appeal an ICO Decision Notice to the First-tier Tribunal (Information Rights) within 28 days of the notice. The Tribunal considers appeals on fact and law, not just law. It can substitute its own Decision Notice. Tribunal hearings are free to bring (though you may need legal support for complex cases), and many journalists have succeeded at this stage after the ICO sided with the authority.

For strategic advice on building your challenge, see our guide to challenging FOI refusals and the FOI for investigations guide.

Checklist for university FOI requests

Verified the institution is listed as a public authority under Schedule 1 Part II of FOIA 2000 (or FOISA in Scotland).
Checked HESA publications, OfS datasets, and the university's published annual accounts before filing.
Searched the university's disclosure log and WhatDoTheyKnow for previous similar requests.
Identified the correct FOI contact — usually the university's FOI officer in the legal or governance team.
Specified the financial or academic year for the data to match the university's reporting cycle.
Requested aggregate statistics rather than identifiable case files or named individuals' records.
For research data: checked whether s.22A (ongoing research) or s.43 (commercial interests) is likely and prepared a public interest argument.
For governance documents: asked for the specific document (minutes, memorandum of understanding, trustee register) rather than a broad class of records.
Set a 20-working-day deadline reminder and prepared an internal review letter in case of refusal.
For Scotland: confirmed the body is subject to FOISA and directed any appeal to the Scottish Information Commissioner.

Not legal advice

This guide is an educational resource for journalists and researchers. It does not constitute legal advice and should not be relied upon as such. FOI law is applied on a case-by-case basis and outcomes depend on the specific information requested, the authority involved, and the applicable public interest considerations. If you are engaged in complex litigation or require a formal legal opinion, consult a solicitor with information law expertise. The Information Law Group and the Campaign for Freedom of Information provide free guidance and support for requesters.

Frequently asked questions

Are all UK universities subject to FOIA?

All higher education bodies listed in Schedule 1 Part II of FOIA 2000 are covered. In practice this means every publicly funded university in England, Wales, and Northern Ireland — including Russell Group institutions, post-1992 universities, and specialist colleges — is required to respond to FOI requests. Purely private providers not regulated by the Office for Students (OfS) or the equivalent funding bodies in Scotland, Wales, and Northern Ireland may fall outside FOIA, but this is a small category. In Scotland, universities are subject to the Freedom of Information (Scotland) Act 2002 and the Scottish Information Commissioner.

Can I obtain research data from a university via FOI?

It depends on what stage the research is at and whether it is genuinely held by the institution. Raw research datasets held by a university are subject to FOIA. However, universities frequently invoke s.22A (research information intended for future publication) or s.43 (commercial interests, particularly where research is commercially sponsored) to withhold datasets. Both are qualified exemptions, meaning a public interest test applies. A request for processed or published research outputs is more straightforward — if the university holds a final report, it should disclose it unless a specific exemption applies.

What is the most common refusal pattern for university FOI requests?

The most frequently cited exemption in the higher education sector is s.40 (personal data), often applied to individual academics' correspondence, complaints, and personnel records. S.43 (commercial interests) is the second most common, typically used to withhold commercial research sponsorship agreements and technology transfer contracts. Where these are applied to aggregate statistics or redacted versions of contracts, they are frequently challenged successfully at internal review or before the ICO. S.22A (ongoing research) is a third common pattern that can be difficult to challenge without knowing whether publication is genuinely planned.

How do I challenge a university FOI refusal?

The process mirrors FOIA generally: first, request an internal review from the university within a reasonable time (the ICO recommends within 40 working days of receiving the refusal). Universities are required to conduct an internal review if asked. If the internal review upholds the refusal, you can complain to the ICO (in England, Wales, and Northern Ireland) or the Scottish Information Commissioner (in Scotland). The ICO can issue a Decision Notice requiring disclosure. If the ICO sides with the university, you can appeal to the First-tier Tribunal (Information Rights) on a point of law or fact.

Does GDPR or UK data protection law affect university FOI requests?

Yes, in two ways. First, s.40 of FOIA (personal data of third parties) is an absolute exemption that incorporates UK GDPR principles — if disclosing information would breach the data protection principles, the university must withhold it. This applies to named individuals' personnel records, student-level data, and academic correspondence containing personal details. Second, individual academics can invoke their own subject access rights under UK GDPR separately from FOIA. The key distinction for journalists: aggregate statistics about staff, complaints, or pay bands are generally not personal data and cannot be legitimately withheld under s.40.

Primary sources

FOIA 2000 Schedule 1 — public authorities list— legislation.gov.uk
ICO guidance on public authorities and FOI— ico.org.uk
JISC — framework and best practice for universities— jisc.ac.uk
HESA — higher education statistics and regulated bodies— hesa.ac.uk

Universities and FOI — The Distinct Process