Data Governance Atlas UK edition

Freedom of Information Act 2000

In force

The general right of access to recorded information held by public authorities in England, Wales and Northern Ireland, and by UK-wide public authorities, including their work in Scotland. Any person may ask, for any reason, and the authority must say whether it holds the information and, unless an exemption applies, provide it within 20 working days. The most misunderstood point is the shape of the exemptions: most are qualified, so engaging one is only half the analysis, and the public interest test decides the outcome. There are no fines under FOIA; the sanction for destroying records to defeat a request is the s.77 offence.

Identity

Citation
Freedom of Information Act 2000, c. 36
Jurisdiction
United Kingdom
Regime
Freedom of information
Applies to
England and Wales, Northern Ireland
Type
Primary legislation
Structure
8 Parts, 88 sections, 8 Schedules
Royal assent
2000-11-30
Main commencement
2005-01-01

The general right of access came into force on 2005-01-01, after publication schemes were phased in from 2002. Amended in place since, including by the DPA 2018 (s.40) and the Protection of Freedoms Act 2012 (datasets).

Amended by: Amended by the Protection of Freedoms Act 2012 (datasets) and by the DPA 2018 (s.40 restated against the UK GDPR and DPA 2018). The DUAA 2025 transferred the regulator's functions to the Information Commission from 2026-09-30.

Reads together with

  • Environmental Information Regulations 2004

    Environmental information is exempt under s.39 so that the EIR apply instead. The requester does not choose.

  • Data Protection Act 2018 and UK GDPR

    Section 40 routes the requester's own data to subject access and applies the data protection principles to third-party data.

  • Section 45 code of practice

    Sets the expected practice for advice and assistance, transfers, consultation and internal review (20 working days).

Structure

What each Part or Chapter does, and the provisions worth knowing inside it. An orientation to the shape of the instrument, not a substitute for reading the official text.

Part I: Access to information held by public authorities (ss.1 to 20)

The right of access, the time limit, fees and costs, vexatious requests, advice and assistance, refusal notices and publication schemes.

  • s.1 Duty to confirm or deny, and to communicate the information.
  • s.2 Absolute and qualified exemptions; the public interest test.
  • s.3 and Sch 1 Which bodies are public authorities.
  • s.8 A valid request is in writing, names the requester, gives an address and describes the information.
  • s.10 20 working days, with a reasonable extension where the public interest test is being considered.
  • s.12 Cost limit for complying.
  • s.14 Vexatious and repeated requests.
  • s.16 Advice and assistance.
  • s.17 Refusal notices.
  • s.19 Publication schemes.
Part II: Exempt information (ss.21 to 44)

The exemptions. Each is either absolute or qualified, and either class-based or prejudice-based.

  • ss.21 to 44 See the exemptions listed below, each with its test.
Part III: General functions (ss.45 to 49)

Codes of practice and the regulator's promotional functions.

  • s.45 Code of practice on discharging FOI functions.
  • s.46 Code of practice on records management.
  • s.48 Practice recommendations.
Part IV: Enforcement (ss.50 to 56)

Complaints to the regulator and the notices it can issue.

  • s.50 Decision notices.
  • s.51 Information notices.
  • s.52 Enforcement notices.
  • s.53 Exception from duty to comply with certain notices (the accountable person's certificate, or veto).
  • s.54 Failure to comply certified to the High Court as contempt.
  • s.56 No right of action in civil proceedings.
Part V: Appeals (ss.57 to 61)

Appeals to the First-tier Tribunal and onward on points of law.

  • s.57 Appeal against a notice.
Parts VI to VIII (ss.62 to 88)

Historical records, amendments to the DPA 1998 (spent) and miscellaneous provisions, including the s.77 offence.

  • s.77 Offence of altering records with intent to prevent disclosure.
  • s.84 Interpretation, including information and working day.

Asymmetry checklist

Ten questions every profile answers explicitly. "None found" means the point was examined and the instrument has nothing distinctive on it.

# Point Finding Notes
1 Territorial extent Asymmetry found Covers public authorities in England, Wales and Northern Ireland and UK-wide public authorities, including their activities in Scotland. Scottish public authorities fall under FOISA 2002, with its own regulator, because freedom of information is devolved in Scotland. Which Act applies turns on the authority, not on where the requester lives.
2 Commencement None found Fully in force since 2005-01-01. No phased or pending provisions affect the right of access. Amendments, such as the datasets provisions from the Protection of Freedoms Act 2012, have been commenced in place.
3 Sunset / mandatory review None found No sunset or statutory review clause. Post-legislative scrutiny has been carried out by Parliament, but the Act imposes no review duty and does not lapse.
4 Criminal liability Asymmetry found One offence, s.77: altering, defacing, blocking, erasing, destroying or concealing a record with intent to prevent disclosure after a request has been made. Summary only, fine not exceeding level 5 (unlimited in England and Wales). Because it is summary only, proceedings must normally start within six months of the offence, which in practice makes prosecutions rare.
5 Civil liability None found None. Section 56 states that the Act confers no right of action in civil proceedings for failure to comply. The routes are internal review, complaint to the Information Commission, appeal to the First-tier Tribunal, and in narrow cases judicial review.
6 Regulatory enforcement toolkit Asymmetry found No monetary penalties. The regulator issues decision notices (s.50), information notices (s.51) and enforcement notices (s.52), and can make practice recommendations (s.48). Failure to comply with a notice can be certified to the High Court and dealt with as contempt (s.54). An accountable person can override certain notices by certificate (s.53).
7 Personal / director liability Asymmetry found The s.77 offence can be committed by the public authority itself and by any person employed by it, an officer of it or subject to its direction. Individuals are therefore directly liable; no director-liability provision is needed.
8 Public vs private sector split Asymmetry found Public sector only. The Act applies to bodies listed in Schedule 1, bodies designated by order under s.5 and publicly-owned companies under s.6. Private bodies are outside it unless designated, however public their functions.
9 Legal-person coverage Asymmetry found The right of access belongs to any person, including companies, campaign groups and journalists, not only individuals. The requester's identity and motive are generally irrelevant, except where s.14 (vexatious requests) is in play.
10 Exemptions, with their conditions Asymmetry found Part II sets out the exemptions, each either absolute (no public interest test) or qualified (subject to the s.2 public interest test), and either class-based or prejudice-based. Absolute exemptions include ss.21, 23, 32, 34, 41 and 44 and parts of ss.36, 37 and 40. Cost (s.12) and vexatious requests (s.14) are grounds for refusal rather than exemptions.

Criminal liability

A distinct track, separate from the regulatory penalties below. The same failure can attract both: a penalty notice against the organisation and a prosecution of the individual.

s.77: Altering etc. records with intent to prevent disclosure Fine only

Where a request has been made and the applicant would have been entitled to the information, it is an offence for the public authority, or a person employed by it, an officer of it or subject to its direction, to alter, deface, block, erase, destroy or conceal any record held by the authority with the intention of preventing its disclosure. The FOI counterpart of DPA 2018 s.173.

Mens reaMens reaThe mental element an offence requires, such as intention, knowledge or recklessness. Most DPA 2018 offences need knowledge or recklessness.Defined in: General criminal law
Intention to prevent disclosure
Penalty
Fine not exceeding level 5 on the standard scale (unlimited in England and Wales); summary only
Imprisonment
Not available

Civil liability

The Act confers no right of action in civil proceedings (s.56). A dissatisfied requester asks for an internal review, then complains to the Information Commission, then appeals to the First-tier Tribunal.

  • s.50 complaint to the regulator

    Information Commission : Normally only after the authority's internal review.

  • s.57 appeal

    First-tier Tribunal (General Regulatory Chamber) : Either party may appeal a decision notice.

Regulatory enforcement

Penalty ceiling
No monetary penalties. Non-compliance with a notice is certified to the High Court and dealt with as contempt (s.54).
  • Decision notice s.50

    Decides a complaint and can require disclosure.

  • Information notice s.51

    Requires the authority to provide information for an investigation.

  • Enforcement notice s.52

    Requires steps to comply with Part I.

  • Practice recommendation s.48

    Recommends steps to conform with the s.45 and s.46 codes.

  • Certification to the High Court s.54

    Non-compliance dealt with as contempt of court.

An accountable person (for government departments, a Cabinet minister) can by certificate exempt the authority from complying with certain decision or enforcement notices (s.53), subject to judicial review.

Personal / director liability

Available
Yes
Basis
s.77(2)

Employees, officers and anyone subject to the authority's direction can be prosecuted personally under s.77.

Legal-person coverage

Covers legal persons
Yes

Any person may make a request, including companies and other legal persons. The Act protects access, not the requester's own data.

Public / private sector split

Separate regimes
Yes

Public authorities only, defined by list and designation rather than by function.

  • Schedule 1

    Listed public authorities: government departments, local authorities, NHS bodies, schools, police and many others.

  • s.5 designation

    Bodies designated by order because they exercise functions of a public nature or provide services under contract with a public authority.

  • s.6

    Companies wholly owned by the Crown or by public authorities.

Exemptions

Recorded with their trigger conditions, not as bare names, most are conditional tests applied case by case rather than blanket carve-outs.

s.21, Information accessible by other means

Trigger

Absolute. Applies where the information is reasonably accessible to the applicant otherwise than under the Act, for example already published.

Disapplies

  • s.1(1)(b) duty to communicate
s.22, Information intended for future publication

Trigger

Qualified, class-based. The information is held with a view to publication at a future date, and it is reasonable in all the circumstances to withhold it until then.

Disapplies

  • s.1(1)(b)
s.22A, Research

Trigger

Qualified, prejudice-based. Information obtained in a continuing programme of research intended for publication, where disclosure before then would, or would be likely to, prejudice the programme, the researcher's interests or the authority's interests.

Disapplies

  • s.1(1)(b)
s.23, Information supplied by, or relating to, bodies dealing with security matters

Trigger

Absolute, class-based. Information directly or indirectly supplied by, or relating to, the bodies listed in s.23(3), such as the security and intelligence agencies.

Disapplies

  • s.1(1)(a) and (b)
s.24, National security

Trigger

Qualified. Applies where exemption is required for the purpose of safeguarding national security. A Minister's certificate is conclusive evidence, subject to appeal.

Disapplies

  • s.1(1)(a) and (b)
s.26, Defence

Trigger

Qualified, prejudice-based. Disclosure would, or would be likely to, prejudice the defence of the British Islands or the capability or security of the armed forces.

Disapplies

  • s.1(1)(a) and (b)
s.27, International relations

Trigger

Qualified, prejudice-based, or class-based for confidential information obtained from another State or an international organisation.

Disapplies

  • s.1(1)(a) and (b)
s.28, Relations within the United Kingdom

Trigger

Qualified, prejudice-based. Disclosure would, or would be likely to, prejudice relations between administrations in the UK.

Disapplies

  • s.1(1)(a) and (b)
s.29, The economy

Trigger

Qualified, prejudice-based. Disclosure would, or would be likely to, prejudice the economic interests of the UK or the financial interests of a UK administration.

Disapplies

  • s.1(1)(a) and (b)
s.30, Investigations and proceedings conducted by public authorities

Trigger

Qualified, class-based. Information held for criminal investigations or proceedings, or obtained from confidential sources for certain investigations.

Disapplies

  • s.1(1)(a) and (b)
s.31, Law enforcement

Trigger

Qualified, prejudice-based. Disclosure would, or would be likely to, prejudice the prevention or detection of crime, the administration of justice, tax collection or other listed functions. Only where s.30 does not apply.

Disapplies

  • s.1(1)(a) and (b)
s.32, Court records

Trigger

Absolute, class-based. Information held only by virtue of being in documents filed with, or created by, a court or tribunal for proceedings.

Disapplies

  • s.1(1)(a) and (b)
s.33, Audit functions

Trigger

Qualified, prejudice-based. Applies to authorities with audit functions where disclosure would, or would be likely to, prejudice those functions.

Disapplies

  • s.1(1)(a) and (b)
s.34, Parliamentary privilege

Trigger

Absolute. Exemption is required to avoid an infringement of the privileges of either House. A certificate from the Speaker or Clerk is conclusive.

Disapplies

  • s.1(1)(a) and (b)
s.35, Formulation of government policy

Trigger

Qualified, class-based. Information held by a government department relating to the formulation or development of government policy, ministerial communications, Law Officers' advice or a ministerial private office.

Disapplies

  • s.1(1)(a) and (b)
s.36, Prejudice to effective conduct of public affairs

Trigger

Qualified, except for information held by either House of Parliament. Engaged only where, in the reasonable opinion of a qualified person, disclosure would, or would be likely to, prejudice the matters listed. The opinion must be reasonable and actually given.

Disapplies

  • s.1(1)(a) and (b)
s.37, Communications with Her Majesty and honours

Trigger

Absolute for communications with the Sovereign, the heir and the second in line; qualified for other members of the Royal Family and Household and for honours.

Disapplies

  • s.1(1)(a) and (b)
s.38, Health and safety

Trigger

Qualified, prejudice-based. Disclosure would, or would be likely to, endanger the physical or mental health or safety of any individual.

Disapplies

  • s.1(1)(a) and (b)
s.39, Environmental information

Trigger

Qualified, class-based. Applies to information the authority must make available under the EIR, so the request is handled under the EIR instead.

Disapplies

  • s.1(1)(a) and (b)

In practice a routing provision rather than a reason to withhold.

s.40(1), Personal information about the requester

Trigger

Absolute. The information is the requester's own personal data. Handled as a subject access request instead.

Disapplies

  • s.1(1)(a) and (b)
s.40(2), Personal information about someone else

Trigger

Absolute where disclosure to the public would contravene the data protection principles (the first condition); otherwise conditions linked to the data subject's rights apply, some subject to the public interest test.

Disapplies

  • s.1(1)(b)

Disclosure under FOIA is treated as disclosure to the world, which is why the principles test is usually decisive.

s.41, Information provided in confidence

Trigger

Absolute. The information was obtained from another person and disclosure would constitute an actionable breach of confidence. A public interest defence to the breach of confidence is built into that test.

Disapplies

  • s.1(1)(b)
s.42, Legal professional privilege

Trigger

Qualified, class-based. Information in respect of which a claim to legal professional privilege could be maintained in legal proceedings. The public interest in maintaining privilege carries substantial inherent weight.

Disapplies

  • s.1(1)(a) and (b)
s.43, Commercial interests

Trigger

Qualified. Trade secrets (class-based), or information whose disclosure would, or would be likely to, prejudice the commercial interests of any person, including the authority.

Disapplies

  • s.1(1)(a) and (b)
s.44, Prohibitions on disclosure

Trigger

Absolute. Disclosure is prohibited by or under another enactment, incompatible with an obligation the statute preserves, or would be contempt of court.

Disapplies

  • s.1(1)(a) and (b)
s.12, Cost of compliance exceeds the appropriate limit

Trigger

Not an exemption: a ground for refusal. Applies where the estimated cost of complying exceeds the appropriate limit set in the fees regulations. Advice and assistance on narrowing the request should be offered (s.16).

Disapplies

  • s.1(1)
s.14, Vexatious or repeated requests

Trigger

Not an exemption: a ground for refusal. The request is vexatious (judged on the request, not the requester, though context and history count), or repeats an identical or substantially similar request without a reasonable interval.

Disapplies

  • s.1(1)

Interactions and conflicts

The cross-instrument texture that profiling an Act in isolation misses, including where the real answer to a question about this Act is found in a different one.

Instrument Relationship Note
Environmental Information Regulations 2004 Cross-reference Section 39 sends environmental information to the EIR. Where both could apply, the EIR govern and its narrower exceptions and presumption in favour of disclosure apply.
Data Protection Act 2018 Reads with Section 40 applies the data protection regime to personal information. FOIA s.77 and DPA s.173 are parallel offences for FOI and subject access requests respectively.
UK GDPR Reads with The s.40(2) first condition asks whether disclosure would contravene the Art 5(1)(a) principle, usually through an Art 6(1)(f) style analysis.
Freedom of Information (Scotland) Act 2002 Cross-reference Scottish public authorities are under FOISA, not FOIA. UK-wide authorities stay under FOIA even for information about Scotland.

Questions answered

The questions this instrument most often raises, with the answer and the authority for it.

Tools, maps and checklists for this instrument

Explainers

Activities this instrument governs

Codes of practice and guidance

Regulators, tribunals and prosecutors

Sources

Updated