FOIA: on request; reviews should be completed within 20 working days, and in exceptional cases no more than 40. (FOIA s.45 code of practice) EIR: mandatory if the requester makes representations within 40 working days; decision within 40 working days. (EIR reg 11) FOISA: mandatory if requested within 40 working days; response within 20 working days. (FOISA ss.20 and 21) EIRS: mandatory if requested within 40 working days; response within 20 working days. (EIRS reg 16)

What happens if it goes wrong?

Regulatory: The requester can complain to the regulator, which issues a decision notice requiring the authority to act. Either side can appeal to the First-tier Tribunal (General Regulatory Chamber), then on a point of law to the Upper Tribunal. Failing to comply with a notice can be certified to the High Court and dealt with as contempt. Missing review deadlines is recorded by the regulator and can lead to monitoring. Criminal: No offence. Civil: No right to compensation. Enforcement runs through the regulator and the tribunal.

What is an internal review, and when must an authority carry one out?

An internal review is the authority reconsidering its own response when the requester is unhappy. It is mandatory under the EIR, EIRS and FOISA, and expected under the FOIA code of practice; requesters normally need one before complaining to the regulator. FOIA reviews should take 20 working days, and no more than 40.

Freedom of information

What it is

A review should be carried out by someone not involved in the original decision, look at the request afresh, and either uphold or change the response. The requester can then complain to the regulator, or in Scotland to the Scottish Information Commissioner.

When and how long

FOIA: on request; reviews should be completed within 20 working days, and in exceptional cases no more than 40. FOIA s.45 code of practice
EIR: mandatory if the requester makes representations within 40 working days; decision within 40 working days. EIR reg 11
FOISA: mandatory if requested within 40 working days; response within 20 working days. FOISA ss.20 and 21
EIRS: mandatory if requested within 40 working days; response within 20 working days. EIRS reg 16

Who is responsible

The authority, with a reviewer independent of the original decision where possible.

What it involves

Acknowledge the review request.
Reconsider the whole request afresh.
Disclose anything wrongly withheld.
Explain the outcome and the right to go to the regulator.

If it goes wrong

Regulatory: The requester can complain to the regulator, which issues a decision notice requiring the authority to act. Either side can appeal to the First-tier Tribunal (General Regulatory Chamber), then on a point of law to the Upper Tribunal. Failing to comply with a notice can be certified to the High Court and dealt with as contempt. Missing review deadlines is recorded by the regulator and can lead to monitoring.
Criminal: No offence.
Civil: No right to compensation. Enforcement runs through the regulator and the tribunal.

Go further

The law: FOIA 2000, EIR 2004, FOISA 2002, EIRS 2004
Procedures: FOI request response (FOIA 2000), EIR request response (EIR 2004), Scottish FOI and EIR response (FOISA 2002, EIRS 2004)

More on freedom of information and environmental information

Sources

Regulator Section 45 code of practice: request handling Information Commissioner's Office
Primary Environmental Information Regulations 2004, regulation 11 legislation.gov.uk
Primary Freedom of Information (Scotland) Act 2002, section 21 legislation.gov.uk
Primary Environmental Information (Scotland) Regulations 2004, regulation 16 legislation.gov.uk

Updated 2026-11-09