The ICO exists to empower you through information.

What do FOIA and the EIR say about requests for personal information?

Part one: Is the request for personal data? 

Part two: Can you confirm or deny holding the requested information?

Part three: The first condition – Would disclosure contravene the data protection principles?

Part four: The second condition – Would disclosure contravene the right to object?

Part five: The third condition – Would the requested third-party personal data be exempt from the right of access? 

Part six: Issuing a refusal notice

What are some common scenarios and what should you include in your refusal notice?