Freedom of Information Request UK: FOIA, FOISA and EIR Explained

Making a freedom of information request means writing to a public authority under one of two different Acts depending on where in the UK that authority sits, England, Wales, Northern Ireland and UK-wide bodies under the Freedom of Information Act 2000, devolved Scottish public authorities under the Freedom of Information (Scotland) Act 2002, though both give you a 20 working day answer.

Which Act applies: FOIA, FOISA or EIR

Freedom of information is not devolved to the Northern Ireland Assembly, so public authorities in Northern Ireland sit under the same UK-wide Freedom of Information Act 2000 (FOIA) as England and Wales, regulated by the Information Commissioner's Office (ICO), not a separate Northern Ireland regulator. Devolved Scottish public authorities instead sit under the Freedom of Information (Scotland) Act 2002 (FOISA), regulated by the Scottish Information Commissioner (SIC).

Where the information requested is environmental, in the broad sense used by the regulations, both FOIA and FOISA give way to a different regime, the Environmental Information Regulations 2004 (EIR) across England, Wales, Northern Ireland and UK bodies, or the Environmental Information (Scotland) Regulations for Scottish authorities. Whether a request is routed as FOI or as EIR is itself a common point of dispute, because EIR is more requester-friendly on cost, covered below.

The 20 working day time limit

FOIA section 10 requires a public authority to "comply with section 1(1) promptly and in any event not later than the twentieth working day following the date of receipt" (legislation.gov.uk: FOIA, section 10). FOISA sets the same 20 working day base limit for ordinary requests, extending to 30 working days where the Keeper of the Records of Scotland is asked for certain historical records.

EIR requests carry their own time limit, separate from FOIA's. Regulation 5(2) of the Environmental Information Regulations 2004 requires that information "shall be made available under paragraph (1) as soon as possible and no later than 20 working days after the date of receipt of the request" (legislation.gov.uk: EIR 2004, regulation 5). Regulation 7 then allows a public authority to extend that period "to 40 working days if it reasonably believes that the complexity and volume of the information requested means that it is impracticable either to comply with the request within the earlier period or to make a decision to refuse to do so" (legislation.gov.uk: EIR 2004, regulation 7).

What it can cost you: two different charging mechanisms, not just two numbers

FOIA's appropriate limit is set by regulation 3 of the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004, which fixes it at "600" for Schedule 1 Part I bodies and "450" for any other public authority, and regulation 6 of the same instrument limits any fee below that limit to the cost of informing you and communicating the information, such as format, reproduction and postage, excluding staff time (legislation.gov.uk: SI 2004/3244, regulation 3; regulation 6). Above the limit an authority may refuse, or may choose to answer for a fee set under regulation 7, which can include staff time (regulation 7).

FOISA's mechanism is genuinely different, not just a different figure. Regulation 5 of the Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004 sets the excessive cost refusal threshold at "600" (legislation.gov.uk: SSI 2004/467, regulation 5), while regulation 4 lets an authority charge for the amount of projected cost between 100 and 600 pounds, and regulation 3 caps chargeable staff time at 15 pounds per hour. The Scottish Information Commissioner explains the practical effect plainly: "it can't charge you for the first 100 pounds it costs to provide you with the information," and above that, "it can charge you 10 percent of the difference between these two amounts. So the maximum an authority could charge you would be 50 pounds" (foi.scot: what might it cost). Above 600 pounds a Scottish authority can refuse, or can choose to answer and first ask you to pay the full cost above the 600 pound limit.

EIR has no fixed cost limit at all. Regulation 8(3) allows only a charge the authority is satisfied "is a reasonable amount," and regulation 8(2) requires that examining information in person, and accessing public registers or lists, is never charged (legislation.gov.uk: EIR 2004, regulation 8).

When the clock can extend, and when a request can be refused

Beyond EIR's 40 working day complexity extension above, FOIA section 10(3) lets the ordinary 20 working day clock extend where a public interest balance exemption applies, to "such time as is reasonable in the circumstances" (legislation.gov.uk: FOIA, section 10). The Act itself does not fix a specific number of extra days for this; how long is reasonable depends on the case. The extension does not affect the time for the authority's written notice, so within 20 working days it must still tell you that it has not yet reached a decision on the public interest and give an estimate of when it will (legislation.gov.uk: FOIA, section 17).

Section 14 lets an authority refuse a request outright where it is vexatious, stating that "section 1(1) does not oblige a public authority to comply with a request for information if the request is vexatious" (legislation.gov.uk: FOIA, section 14). The same section also lets an authority refuse an identical or substantially similar repeat request from the same person, unless a reasonable interval has passed since it last complied. FOISA carries an equivalent vexatious-request ground for Scottish authorities. Beyond cost and vexatious requests, both Acts also set out a list of exemptions, some absolute and some qualified and subject to a public interest test, in Part II of FOIA and the equivalent part of FOISA.

If a request is refused: internal review, then the regulator

Ask the public authority for an internal review first. The Information Commissioner's Office is clear that "you may need to have requested an internal review before you can make a complaint" (ico.org.uk: FOI and EIR complaints). Only after that do you escalate, to the ICO for FOIA or EIR matters in England, Wales and Northern Ireland, or to the Scottish Information Commissioner for FOISA or EISR matters.

If you disagree with the regulator's decision, an Information Commissioner decision under FOIA can be appealed to the First-tier Tribunal (legislation.gov.uk: FOIA, section 57), and a Scottish Information Commissioner decision can be appealed on a point of law to the Court of Session (legislation.gov.uk: FOISA, section 56). In Scotland, an application to the Scottish Information Commissioner must normally be made within six months of the authority's review response (legislation.gov.uk: FOISA, section 47).

An FOI complaint to the ICO is a different statutory route from a data protection complaint, even though both go to the same regulator. If you want information a public body holds about someone or something else, that is FOI. If you want the personal data an organisation holds about you, that is a subject access request under UK GDPR, and a complaint about how that was handled is a separate journey. See subject access requests for that process and complaining to the ICO for the general ICO complaints procedure, which an FOI complaint also uses but for a different underlying right.

The regulator's legal structure is changing on 30 September 2026, not its job

From 30 September 2026, the Data (Use and Access) Act 2025 transfers the Information Commissioner's statutory functions to a new body, the Information Commission. Section 119 of the Act provides that "the functions of the Information Commissioner are transferred to the Information Commission," with existing references to the Commissioner in any enactment read as references to the Commission going forward (legislation.gov.uk: Data (Use and Access) Act 2025, section 119). That section is commenced by regulation 2 of the 2026 commencement regulations, which brings it into force "on 30th September 2026" (legislation.gov.uk: SI 2026/1015), and a related instrument makes the consequential textual change to FOIA itself, substituting "Commission" for "Commissioner" through the Act's enforcement and appeal sections (legislation.gov.uk: SI 2026/386).

This is a change to the legal person holding the office, from a single Commissioner to a corporate Commission, not a rebrand of the public-facing name. The ICO's own explanation for organisations describes the change as restructuring rather than a new identity: it "changes our structure" into "a stronger and modernised structure" (ico.org.uk: the Data (Use and Access) Act 2025, what it means for organisations). The ICO has confirmed it will continue to be known as the ICO (ico.org.uk: ICO governance changes confirmed for 30 September 2026). The Scottish Information Commissioner, a separate devolved office under FOISA, is not affected by this UK-wide change to the Information Commissioner's structure (legislation.gov.uk: FOISA, section 42).

For the wider UK public records hub, including certificate ordering and land registry searches, see the section hub.

Frequently Asked Questions

How long does a public authority have to respond to an FOI request?

20 working days under FOIA, and the same 20 working days under FOISA in Scotland, extending to 30 for the Keeper of the Records of Scotland on certain historical records. An environmental information request under EIR also starts at 20 working days but can extend to 40 for genuinely complex or voluminous requests.

Can a public authority charge me for a freedom of information request?

Under FOIA, only disbursements such as copying and postage below the 600 or 450 pound appropriate limit; above that, the authority can refuse, or choose to answer for a fee that can include staff time. Under FOISA, an authority can charge up to 50 pounds for a request costing it between 100 and 600 pounds to fulfil, and refuse above 600 pounds. EIR has no fixed cost limit, only a reasonable charge, and inspection in person is always free.

What is the difference between an FOI request and an environmental information request?

Environmental information requests run under EIR or Scotland's EISR, which have no fixed cost limit and can extend to 40 working days for complex or voluminous requests. FOIA and FOISA instead let an authority refuse outright once a fixed cost limit is exceeded.

What can I do if my FOI request is refused?

Ask the public authority for an internal review first. If you are still unhappy, complain to the Information Commissioner's Office for FOIA or EIR matters, or the Scottish Information Commissioner for FOISA or EISR matters. A regulator's decision can then be appealed, to the tribunal for FOIA or to the Court of Session on a point of law for FOISA.

Is the ICO becoming the Information Commission?

From 30 September 2026, the Data (Use and Access) Act 2025 transfers the Information Commissioner's statutory functions to a body called the Information Commission. This changes the legal structure holding the office; the ICO has confirmed it will continue to be known as the ICO.

Is a freedom of information request the same as a subject access request?

No. A freedom of information request asks a public body for information it holds generally. A subject access request asks specifically for the personal data an organisation holds about you, under UK GDPR, and is a separate right with its own process.