Section 21 – information already reasonably accessible
This exemption applies if the information requested is already accessible to the requester. You could apply this if you know that the requester already has the information, or if it is already in the public domain. For this exemption, you will need to take into account any information the requester gives you about their circumstances. For example, if information is available to view in a public library in Southampton, it may be reasonably accessible to a local resident but not to somebody living in Glasgow. Similarly, an elderly or infirm requester may tell you they don’t have access to the internet at home and find it difficult to go to their local library, so information available only over the internet would not be reasonably accessible to them.
When applying this exemption, you have a duty to confirm or deny whether you hold the information, even if you are not going to provide it. You should also tell the requester where they can get it.
This exemption is absolute, so you do not need to apply the public interest test.
For further information, read our more detailed guidance:
Section 22 – information intended for future publication
This exemption applies if, when you receive a request for information, you are preparing the material and definitely intend for it to be published, and it is reasonable not to disclose it until then. You do not need to have identified a publication date. This exemption does not necessarily apply to all draft materials or background research. It will only apply to the material you intend to be published.
You do not have to confirm whether you hold the information requested if doing so would reveal the content of the information.
This exemption is qualified by the public interest test.
For further information, read our more detailed guidance:
Section 22A – research information
This exemption applies if, when you receive a request for information,
you hold information on an ongoing programme of research;
there is an intention by someone –whether an individual or organisation, private or public sector - to publish a report of the research; and
disclosure of the information would or would be likely to prejudice the research programme, the interests of participants in the programme, or a public authority holding or intending to publish a report of the research.
So long as the research programme is continuing, the exemption may apply to a wide range of information relating to the research project. There does not have to be any intention to publish the particular information that has been requested, nor does there need to be an identified publication date.
You do not have to confirm whether you hold the information requested if doing so would reveal the content of the information.
This exemption is qualified by the public interest test.
For further information, read our more detailed guidance:
Sections 23 and 24 – security bodies and national security
The section 23 exemption applies to any information you have received from, or relates to, any of a list of named security bodies such as the security service. You do not have to confirm or deny whether you hold the information, if doing so would reveal anything about that body or anything you have received from it. A government minister can issue a certificate confirming that this exemption applies.
This exemption is absolute, so you do not need to consider the public interest test.
The section 24 exemption applies if it is “required for the purpose of safeguarding national security”. The exemption does not apply just because the information relates to national security.
A government minister can issue a certificate confirming that this exemption applies and this can only be challenged on judicial review grounds. However, the exemption is qualified by the public interest test.
Section 25 is not an exemption, but gives more detail about the ministerial certificates mentioned above.
For further information, read our more detailed guidance:
Sections 26 to 29
These exemptions are available if complying with the request would prejudice or would be likely to prejudice the following:
defence (section 26);
the effectiveness of the armed forces (section 26);
international relations (section 27);
relations between the UK government, the Scottish Executive, the Welsh Assembly and the Northern Ireland Executive (section 28);
the economy (section 29); or
the financial interests of the UK, Scottish, Welsh or Northern Irish administrations (section 29).
Section 27 also applies to confidential information obtained from other states, courts or international organisations.
All these exemptions are qualified by the public interest test.
For further information, read our more detailed guidance:
Sections 30 and 31 – investigations and prejudice to law enforcement
The section 30 exemption applies to a specific category of information that a public authority currently holds or has ever held for the purposes of criminal investigations. It also applies to information obtained in certain other types of investigations, if it relates to obtaining information from confidential sources.
When information does not fall under either of these headings, but disclosure could still prejudice law enforcement, section 31 is the relevant exemption.
Section 31 only applies to information that does not fall into the categories in section 30. For this reason sections 30 and 31 are sometimes referred to as being mutually exclusive. Section 31 applies where complying with the request would prejudice or would be likely to prejudice various law enforcement purposes (listed in the Act) including preventing crime, administering justice, and collecting tax. It also protects certain other regulatory functions, for example those relating to health and safety and charity administration.
Both exemptions are qualified by the public interest test.
For further information, read our more detailed guidance:
Section 32 – court records
This exemption applies to court records held by any authority (though courts themselves are not covered by the Act).
To claim this exemption, you must hold the information only because it was originally in a document created or used as part of legal proceedings, including an inquiry, inquest or arbitration.
This is an unusual exemption because the type of document is relevant, as well as the content and purpose of the information they hold.
This exemption is absolute, so you do not need to apply the public interest test. You also do not have to confirm or deny whether you hold any information that is or would fall within the definition above.
For further information, read our more detailed guidance:
Section 33 – prejudice to audit functions
This exemption can only be used by bodies with audit functions. It applies where complying with the request would prejudice or would be likely to prejudice those functions.
This exemption is qualified by the public interest test.
For further information, read our more detailed guidance:
Section 34 – parliamentary privilege
You can use this exemption to avoid an infringement of parliamentary privilege. Parliamentary privilege protects the independence of Parliament and gives each House of Parliament the exclusive right to oversee its own affairs. Parliament itself defines parliamentary privilege, and the Speaker of the House of Commons can issue a certificate confirming that this exemption applies; the Clerk of the Parliaments can do the same for the House of Lords.
This exemption is absolute, so you do not need to apply the public interest test.
For further information, read our more detailed guidance:
Sections 35 and 36 – government policy and prejudice to the effective conduct of public affairs
These two sections form a mutually exclusive pair of exemptions in the same way as section 30 and section 31.
The section 35 exemption can only be claimed by government departments or by the Welsh Assembly Government. It is a class-based exemption, for information relating to:
the formulation or development of government policy;
communications between ministers;
advice from the law officers; and
the operation of any ministerial private office.
Section 35 is qualified by the public interest test.
For policy-related information held by other public authorities, or other information that falls outside this exemption but needs to be withheld for similar reasons, the section 36 exemption applies.
The section 36 exemption applies only to information that falls outside the scope of section 35. It applies where complying with the request would prejudice or would be likely to prejudice “the effective conduct of public affairs”. This includes, but is not limited to, situations where disclosure would inhibit free and frank advice and discussion.
This exemption is broad and can be applied to a range of situations.
Example A council refused to disclose a list of schools facing financial difficulties, because this could damage the schools’ ability to recruit pupils, as well as making schools less likely to co-operate and share financial information freely with the council (ICO decision notice FS50302293).
A university refused to disclose a complete list of staff email addresses. On a previous occasion when email addresses had been disclosed, this led to a security attack, as well as an increase in spam, phishing, and emails directed inappropriately (ICO decision notice FS50344341).
The Cabinet Office refused to release details of the discussions between political parties that took place between the general election and the formation of the coalition government. This was necessary to ensure that a stable government could be formed, as politicians needed to be able to freely discuss their differences as well as seek impartial advice from the civil service (ICO decision notice FS50350899).
Section 36 differs from all other prejudice exemptions in that the judgement about prejudice must be made by the legally authorised qualified person for that public authority. A list of qualified people is given in the Act, and others may have been designated. If you have not obtained the qualified person’s opinion, then you cannot rely on this exemption. The qualified person’s opinion must also be a “reasonable” opinion, and the Information Commissioner may decide that the section 36 exemption has not been properly applied if they find that the opinion given isn’t reasonable.
In most cases, section 36 is a qualified exemption. This means that even if the qualified person considers that disclosure would cause harm, or would be likely to cause harm, you must still consider the public interest. However, for information held by the House of Commons or the House of Lords, section 36 is an absolute exemption so you do not need to apply the public interest test.
For further information, read our more detailed guidance:
Section 37 – communications with the royal family and the granting of honours
This exemption has been changed since the Freedom of Information Act was first published, so you should refer to an up-to-date copy at www.legislation.gov.uk.
It covers any information relating to communications with the royal family and information on granting honours. This exemption is absolute in relation to communications with the monarch, the heir to the throne, and the second in line of succession to the throne, so the public interest test does not need to be applied in these cases.
All other information under the scope of this exemption is qualified, so the public interest test must be applied.
For further information, read our more detailed guidance:
Section 38 – endangering health and safety
You can apply the section 38 exemption if complying with the request would or would be likely to endanger anyone’s physical or mental health or safety. In deciding whether you can apply this exemption, you should use the same test as you would for prejudice. This exemption is qualified by the public interest test.
For further information, read our more detailed guidance:
Section 39 – environmental information
You should deal with any request that falls within the scope of the Environmental Information Regulations 2004 under those Regulations. This exemption confirms that, in practice, you do not also need to consider such requests under the Freedom of Information Act.
Only public authorities that are covered by the Regulations can rely on this exemption. A small number of public authorities, including the BBC and other public service broadcasters, are not subject to the Environmental Information Regulations. They should handle requests for environmental information under the Freedom of Information Act.
This exemption is qualified by the public interest test, but because you must handle this type of request under the Environmental Information Regulations, it is hard to imagine when it would be in the public interest to also consider it under the Freedom of Information Act.
Section 40(1) – personal information of the requester
This exemption confirms that you should treat any request made by an individual for their own personal data as a data protection subject access request. You should apply this to any part of the request that is for the requester’s own personal data. They should not be required to make a second, separate subject access request for these parts of their request. See our Guide to UK GDPR - Right of Access for advice on how to handle subject access requests.
If the information contains some of the requester’s personal data plus other non-personal information, then you will need to consider releasing some of the information under the UK GDPR or the DPA 2018 and some under the Freedom of Information Act.
This exemption is absolute, so you do not need to apply the public interest test.
Requested information may involve the personal data of both the requester and others. For further information, read our guidance:
Section 40(2) – Personal information
This exemption covers the personal data of third parties (anyone other than the requester) where complying with the request would breach any of the principles in the UK GDPR.
If you wish to rely on this exemption, you need to refer to the UK GDPR as the data protection principles are not set out in the Freedom of Information Act. More details can be found in our Guide to the UK GDPR - the Principles.
This exemption can only apply to information about people who are living; you cannot use it to protect information about people who have died.
The most common reason for refusing information under this exemption is that disclosure would contravene UK GDPR principle (a) because there is no lawful basis for processing. Section 40(2) is an absolute exemption, so you do not need to apply the public interest test. However, you may need to include public interest arguments when considering lawfulness under principle (a).
Section 40 includes other provisions for people’s data protection rights, and these provisions are qualified by a public interest test.
For further information, read our more detailed guidance:
Section 41 – confidentiality
This exemption applies if the following two conditions are satisfied:
you received the information from someone else; and
complying with the request would be a breach of confidence that is actionable (further information about what is meant by actionable is provided in our detailed guidance below).
You cannot apply this exemption to information you have generated within your organisation, even if it is marked “confidential”. However, you can claim it for information you originally received from someone else but then included in your own records.
To rely on this exemption, you must apply the legal principles of the common law test of confidence, which is a well established though developing area of law.
This exemption is absolute so you do not need to apply the public interest test. However, you will still need to consider the public interest in disclosure, because the law of confidence recognises that a breach of confidence may not be actionable when there is an overriding public interest in disclosure.
You should carefully consider how you use confidentiality clauses in contracts with third parties and set reasonable levels of expectations about what may be disclosed.
For further information, read our more detailed guidance:
Section 42 – legal professional privilege
This applies whenever complying with a request would reveal information that is subject to ‘legal professional privilege’ (LPP) or the equivalent Scottish rules. LPP protects information shared between a client and their professional legal advisor (solicitor or barrister, including in-house lawyers) for the purposes of obtaining legal advice or for ongoing or proposed legal action. These long-established rules exist to ensure people are confident they can be completely frank and candid with their legal adviser when obtaining legal advice, without fear of disclosure.
This exemption is qualified by the public interest test.
For further information, read our more detailed guidance:
Section 43 – trade secrets and prejudice to commercial interests
This exemption covers two situations:
when information constitutes a trade secret (such as the recipe for a branded product); or
when complying with the request would prejudice or would be likely to prejudice someone’s commercial interests.
Both parts of this exemption are qualified by the public interest test.
For further information, read our more detailed guidance:
Section 44 – prohibitions on disclosure
You can apply this exemption if complying with a request for information:
is not allowed under law;
would be contrary to a retained EU obligation; or
would constitute contempt of court.
This exemption is often used by regulators. For example, the Information Commissioner is prohibited by section 132 in Part 5 of the DPA 2018 from disclosing certain information they have obtained in the course of their duties, except in specified circumstances.
The Freedom of Information Act does not override other laws that prevent disclosure, which we call ‘statutory bars’.
This exemption is absolute, so you do not need to apply the public interest test, but bear in mind that some statutory bars may refer to the public interest.
For further information, read our more detailed guidance: