The ICO exists to empower you through information.

Responding to a request

Share Download options

Pages

Format

At a glance

You have two separate duties when responding to these requests:

  • to tell the applicant whether you hold any information falling within the scope of their request; and
  • to provide that information

You normally have 20 working days to respond to a request.

However, this does not mean you are always obliged to provide the information. In some cases, there will be a good reason why you should not make public some or all of the information requested.

You can refuse an entire request under the following circumstances:

  • It would cost too much or take too much staff time to deal with the request.
  • The request is vexatious.
  • The request repeats a previous request from the same person.

In addition, the Freedom of Information Act contains a number of exemptions that allow you to withhold information from a requester. In some cases it will allow you to refuse to confirm or deny whether you hold information.

If you are refusing all or any part of a request, you must send the requester a written refusal notice. You will need to issue a refusal notice if you are either refusing to say whether you hold information at all, or confirming that information is held but refusing to release it.

In brief

Do we have to release the information?

Yes, under the law you must release the information unless there is good reason not to. For more about when you may be able to refuse the request, or withhold some or all of the information, see When can we refuse a request?.

Do we have to tell them what information we have?

Yes, unless one of the reasons for refusing to do this applies – see When can we refuse a request? for details.

You have two duties when responding to requests for information: to let the requester know whether you hold the information, and to provide the information. If you are giving out all the information you hold, this will fulfil both these duties. If you are refusing all or part of the request, you will normally still have to confirm whether you hold (further) information. You do not need to give a description of this information; you only have to say whether you have any (further) information that falls within the scope of the request.

In some circumstances, you can refuse to confirm or deny whether you hold any information. For example, if a requester asks you about evidence of criminal activity by a named individual, saying whether you hold such information could be unfair to the individual and could prejudice any police investigation. We call this a ‘neither confirm nor deny’ (NCND) response.

For further information, read our more detailed guidance:

In what format should we give the requester the information?

There are a number of ways you could make information available, including by email, as a printed copy, on a disk, or by arranging for the requester to view the information. Normally, you should send the information by whatever means is most reasonable. For example, if the requester has made their request by email, and the information is an electronic document in a standard form, then it would be reasonable for you to reply by email and attach the information.

However, requesters have the right to specify their preferred means of communication, in their initial request. So you should check the original request for any preferences before sending out the information.

You may also want to consider whether you would like to include anything else with the information, such as a copyright notice for third party information, or explanation and background context.

Remember that disclosures under the Act are ‘to the world’, so anyone may see the information.

If the information that you are making available is a dataset, and the requester has expressed a preference for an electronic copy, then, so far as reasonably practicable, you must provide the dataset in a re-usable form.

If your authority is also a public sector body under the Re-use of Public Sector Information Regulations 2015 (RPSI) then you should deal with licensing re-use under the terms of RPSI. If RPSI does not apply you should license re-use according to the dataset provisions in the Act. These say that if the dataset is a ‘relevant copyright work’ and you are the only owner of the copyright or database rights, then you must make it available under a licence that permits re-use. The licences to use for this are specified in the section 45 code of practice on datasets. If the dataset can be re-used without charge, then the appropriate licence will usually be the Open Government Licence.

For further information, read our more detailed guidance:

Does the Freedom of Information Act allow us to disclose information to a specific person or group alone?

Disclosures under the Act are ‘to the world’. However, you can restrict the release of information to a specific individual or group at your discretion, outside the provisions of the Act.

If you make a restricted disclosure, you should make it very clear to the requester that the information is for them alone; many requesters are satisfied with this.

However, if the requester has made it clear that they want the information under the Act and are not satisfied with receiving it on a discretionary basis, you can give them the information, but you may also need to give them a formal refusal notice, explaining why you have not released it under the Act. See When can we refuse a request? for more details about refusal notices.

Is there anything else we should consider before sending the information?

You should double check that you have included the correct documents, and that the information you are releasing does not contain unnoticed personal data or other sensitive details which you did not intend to disclose.

This might be a particular issue if you are releasing an electronic document. Electronic documents often contain extra hidden information or ‘metadata’ in addition to the visible text of the document. For example, metadata might include the name of the author, or details of earlier draft versions. In particular, a spreadsheet displaying information as a table will often also contain the original detailed source data, even if this is not immediately visible at first glance.

You should ensure that staff responsible for answering requests understand how to use common software formats, and how to strip out any sensitive metadata or source data (eg data hidden behind pivot tables in spreadsheets).

See the National Archives Redaction Toolkit for further information, or read our more detailed guidance: