The Freedom of Information (FOI) Act

Responding to a Freedom of Information request

Guide

Although the Freedom of Information (FOI) Act imposes legal duties mainly on public authorities, in practice it can also affect private sector businesses.

If your business works for a public authority, the FOI Act may apply to the information you hold. The public authority may therefore contact you about requests it receives for that information.

How to respond to an FOI request

If you receive an FOI request, you must respond within 20 working days.

When you receive a request, you should first consider if it is:

  • Valid under the FOI Act - To be valid, it must be made in writing, and include the name and address of the person requesting the information.
  • Clear and unambiguous - You can ask for clarification if the request is unclear. You do not have to comply with it until you have received clarification.

You should also consider if you have a duty under the Act to provide advice and assistance to people requesting information from you.

When responding to a request, you can:

  • release the information, if you have it
  • acknowledge that you do not hold the information
  • transfer the request to another authority, if they have this information
  • withhold the information by applying an exemption (if you have valid reasons) and explain why
  • acknowledge that you need more time to consider the request

You may need more time if FOI exemptions apply and you need to carry out the public interest test for disclosure. In such cases, you should inform the requestor of the delay within the first 20 days and provide a full response within a maximum of 40 days of receiving the request.

Download guidance on time limits for compliance under the FOI Act (PDF, 351K).

For more information, download the FOI request handling flowchart (PDF, 190K).

Keep in mind that anyone making an FOI request can complain to the Information Commissioner's Office if you refuse their request, or don't comply with the law. However, they must exhaust the internal process before going to ICO, ie request an internal review.