The ICO exists to empower you through information.

Freedom of information

Share
Latest updates

11 October 2022 - We have added five new FAQs for SMEs. These cover what the Freedom of Information Act (FOIA) is, who it applies to, and what you need to do if you receive an FOIA request.

What is the Freedom of Information Act (FOIA)?

The Freedom of Information Act (FOIA) lets members of the public ask to see information held by public authorities such as schools, councils and healthcare providers. It also means public authorities have to publish some information about what they do.

The FOIA doesn’t apply to most small businesses, unless you’re a public authority, or working on behalf of one.

Note: the FOIA covers recorded information held by a public authority in England, Wales and Northern Ireland. It doesn’t apply to Scottish public authorities, except where UK-wide bodies are based in Scotland, such as the Forestry Commission and the Student Loans Company. The Scottish rules are set out in the Freedom of Information (Scotland) Act 2002, and Environmental Information (Scotland) Regulations 2004 and these are regulated by the Scottish Information Commissioner.

Also see:

When does the Freedom of Information Act (FOIA) apply to my small business?

The Freedom of Information Act (FOIA) doesn’t generally apply to limited companies, sole traders or charities. However, if you supply services on behalf of a public authority, you may hold information in connection with those services which could be requested under FOIA.

The public authority is responsible for responding to the request, and for deciding whether the information can be released to the public. You must support them by providing any information you have that they’ll need for their reply.

Also see:

How do I deal with a request under the Freedom of Information Act (FOIA) as a small business?

You don’t need to deal with requests under the Freedom of Information Act (FOIA) as a small privately-owned business unless you provide services on behalf of a public authority. But if you do hold information on behalf of a public authority, this will potentially come under the FOIA.

If you get an FOIA request, you should redirect it to the public authority that you’re working with, as it’s their responsibility to reply. However, you must support them in providing any information they’ll need for their reply.

For example, a local authority has contracted Jill’s private care company to respond to personal alarm activations for vulnerable people. Ken, a member of the public, requests information about how often the care company responds to activations, and how long it takes them to respond. Ken sends his request to the private care company. Jill recognises this as a Freedom of Information request, and passes it on to the local authority, along with the information Ken has asked for. The local authority provides the response within 20 days of the request being made.

Also see:

I’m a small public authority. How do I respond to Freedom of Information Act (FOIA) requests?

You must reply to a Freedom of Information Act (FOIA) request promptly, and you normally have up to 20 working days to respond.

Start by reading the request carefully and make sure you know what’s being asked for. If it isn’t clear, contact the requester as soon as possible for clarification.

Search your records for the information. These aren’t limited to official documents. The information you need to provide could include drafts, emails, notes, meta-data, work conversations on messaging platforms, recordings of telephone conversations, and CCTV recordings.

Provide information in your records that answers the request, unless there’s a good reason not to. The FOIA sets out when you can refuse to respond to a request. You must let the requester know you won’t be responding to the request by sending them a written refusal notice.

Let the requester know in writing if you don’t have the information that’s been asked for.

You only need to provide information you hold in a recorded form. This means if an answer to a question isn’t recorded, you don’t have to provide the information, even though someone may have the answer in their head.

If you know the information is held by another public authority, you can either transfer the request to them, or tell the requester where to redirect their enquiry.

Also see:

I’m a small public authority. When can I refuse a request for information under the Freedom of Information Act (FOIA)?

You should always aim to provide information that’s been asked for. In some cases, there may be a good reason why you shouldn’t make public some or all of the information requested.

Here are the reasons you can refuse a request:

  • Responding would cost more than the set limit. This is currently set at £600 for central government, Parliament and the armed forces and £450 for all other public authorities.
  • The request is vexatious, or in other words, it has the potential to cause a disproportionate or unjustified level of disruption, irritation or distress.
  • The request repeats previous requests from the same person (unless a reasonable period has elapsed).

Where appropriate, you can ask the requestor to clarify or narrow down their request eg if the original request could be refused because it will exceed the set cost limit.

The FOIA also contains a number of exemptions that protect information that could be harmful to another person, or the public interest, if released.

If you’re refusing a request for information, you’ll need to send the requestor a refusal notice, explaining why. You must send this within 20 working days of receiving the request. Your refusal notice should be written clearly. Where possible, avoid using jargon or abbreviations.

Also see: