Key considerations & legal obligations
Requesters must include their real name. Requests can be made in the name of an organisation, or by one person on behalf of another, such as a solicitor on behalf of a client. The requester must include an address for correspondence which you can write to them. If the requester does not provide a postal or email address for you to respond to the request then you do not need to respond.
Time limits
20 working days, counting the first working day after the request is received as the first day. For schools, the standard time limit is 20 school days, or 60 working days if this is shorter (this will usually only apply during the summer holidays).
Clarification & unclear requests
If you can’t answer the request because you are not sure what is being requested, you must contact the requester as soon as possible for clarification. You do not have to deal with the request until you have received that clarification.
ID requirements
Requesters do not have to provide ID. You may decide to check their identity if it is clear they are using a pseudonym, or there are legitimate grounds for refusing their request and you suspect they are trying to avoid this happening. This might happen when you suspect the requester is trying to avoid you relying on the vexatious or repeated requests exemption.
Exemptions
The ICO website has detailed guidance on how to apply the various exemptions under the act. You will also need to consider the £450 cost limit. You can refuse a request if you estimate that the cost of compliance would exceed this limit. When estimating the cost, you can only take into account the cost of determining whether you hold the information; finding the information, or records containing the information; retrieving the information or records; and extracting the information from records. You should rate staff time at £25 per person per hour, regardless of who does the work.
When and what to redact
Generally you will not be releasing personal data in response to an FOI. You will need to consider whether any affected data subjects have consented or refused for the information to be disclosed. Even if they have refused, you should consider whether the requester is pursuing a legitimate interest and whether disclosure of the personal information is necessary to meet those interests. You would then need to consider the “balancing test”, which involves considering whether the legitimate interests served by the disclosure outweigh “the interests or fundamental rights and freedoms of the data subject which require the protection of personal data”. When conducting the balancing test, you should consider: the potential harm or distress that disclosure would cause; the extent to which the information is already in the public domain; the extent to which the information is already known to some people; whether the individual has expressed concern or objected to the disclosure; and the data subject’s reasonable expectations of privacy.
Common mistakes
Trusts will often state that there are no grounds to ever disclose personal data in response to an FOI, or assume that queries regarding named individuals should be addressed in full.
Why this matters
Undertaking internal reviews for FOIs can be time consuming for staff. Inaccurate application of the exemptions would result in a data breach as per UK GDPR, which could result in regulatory action from the ICO and/or civil action by the affected data subjects. If the ICO reviews an FOI decision, that review will be published on their website, which may lead to negative publicity.
Decision tree
Work through the questions below to decide whether third-party personal data should be redacted from an FOI response.
Interactive guide · Third-party data
Does the request include personal data as defined in UK GDPR?
Start by deciding whether the requested information is personal data at all.
Related guides
- SARSubject Access RequestsWhat a SAR is, how long you have to respond, and how to handle third-party data and redactions correctly.
- SAR v FOISAR v FOI ComparisonHow SARs and FOI requests differ — the law behind each, what to redact, and a side-by-side comparison.
- PEXPupil Exclusion InformationThe statutory information owed when excluding a pupil, the timescales involved, and what must be redacted from notices and witness statements.