Freedom of Information Act 2000
In forceThe general right of access to recorded information held by public authorities in England, Wales and Northern Ireland, and by UK-wide public authorities, including their work in Scotland. Any person may ask, for any reason, and the authority must say whether it holds the information and, unless an exemption applies, provide it within 20 working days. The most misunderstood point is the shape of the exemptions: most are qualified, so engaging one is only half the analysis, and the public interest test decides the outcome. There are no fines under FOIA; the sanction for destroying records to defeat a request is the s.77 offence.
Identity
- Citation
- Freedom of Information Act 2000, c. 36
- Jurisdiction
- United Kingdom
- Regime
- Freedom of information
- Applies to
- England and Wales, Northern Ireland
- Type
- Primary legislation
- Structure
- 8 Parts, 88 sections, 8 Schedules
- Royal assent
- 2000-11-30
- Main commencement
- 2005-01-01
The general right of access came into force on 2005-01-01, after publication schemes were phased in from 2002. Amended in place since, including by the DPA 2018 (s.40) and the Protection of Freedoms Act 2012 (datasets).
Amended by: Amended by the Protection of Freedoms Act 2012 (datasets) and by the DPA 2018 (s.40 restated against the UK GDPR and DPA 2018). The DUAA 2025 transferred the regulator's functions to the Information Commission from 2026-09-30.
Reads together with
- Environmental Information Regulations 2004
Environmental information is exempt under s.39 so that the EIR apply instead. The requester does not choose.
- Data Protection Act 2018 and UK GDPR
Section 40 routes the requester's own data to subject access and applies the data protection principles to third-party data.
- Section 45 code of practice
Sets the expected practice for advice and assistance, transfers, consultation and internal review (20 working days).
Structure
What each Part or Chapter does, and the provisions worth knowing inside it. An orientation to the shape of the instrument, not a substitute for reading the official text.
Part I: Access to information held by public authorities (ss.1 to 20)
The right of access, the time limit, fees and costs, vexatious requests, advice and assistance, refusal notices and publication schemes.
- s.1 Duty to confirm or deny, and to communicate the information.
- s.2 Absolute and qualified exemptions; the public interest test.
- s.3 and Sch 1 Which bodies are public authorities.
- s.8 A valid request is in writing, names the requester, gives an address and describes the information.
- s.10 20 working days, with a reasonable extension where the public interest test is being considered.
- s.12 Cost limit for complying.
- s.14 Vexatious and repeated requests.
- s.16 Advice and assistance.
- s.17 Refusal notices.
- s.19 Publication schemes.
Part II: Exempt information (ss.21 to 44)
The exemptions. Each is either absolute or qualified, and either class-based or prejudice-based.
- ss.21 to 44 See the exemptions listed below, each with its test.
Part III: General functions (ss.45 to 49)
Codes of practice and the regulator's promotional functions.
- s.45 Code of practice on discharging FOI functions.
- s.46 Code of practice on records management.
- s.48 Practice recommendations.
Part IV: Enforcement (ss.50 to 56)
Complaints to the regulator and the notices it can issue.
- s.50 Decision notices.
- s.51 Information notices.
- s.52 Enforcement notices.
- s.53 Exception from duty to comply with certain notices (the accountable person's certificate, or veto).
- s.54 Failure to comply certified to the High Court as contempt.
- s.56 No right of action in civil proceedings.
Part V: Appeals (ss.57 to 61)
Appeals to the First-tier Tribunal and onward on points of law.
- s.57 Appeal against a notice.
Parts VI to VIII (ss.62 to 88)
Historical records, amendments to the DPA 1998 (spent) and miscellaneous provisions, including the s.77 offence.
- s.77 Offence of altering records with intent to prevent disclosure.
- s.84 Interpretation, including information and working day.
Asymmetry checklist
Ten questions every profile answers explicitly. "None found" means the point was examined and the instrument has nothing distinctive on it.
| # | Point | Finding | Notes |
|---|---|---|---|
| 1 | Territorial extent | Asymmetry found | Covers public authorities in England, Wales and Northern Ireland and UK-wide public authorities, including their activities in Scotland. Scottish public authorities fall under FOISA 2002, with its own regulator, because freedom of information is devolved in Scotland. Which Act applies turns on the authority, not on where the requester lives. |
| 2 | Commencement | None found | Fully in force since 2005-01-01. No phased or pending provisions affect the right of access. Amendments, such as the datasets provisions from the Protection of Freedoms Act 2012, have been commenced in place. |
| 3 | Sunset / mandatory review | None found | No sunset or statutory review clause. Post-legislative scrutiny has been carried out by Parliament, but the Act imposes no review duty and does not lapse. |
| 4 | Criminal liability | Asymmetry found | One offence, s.77: altering, defacing, blocking, erasing, destroying or concealing a record with intent to prevent disclosure after a request has been made. Summary only, fine not exceeding level 5 (unlimited in England and Wales). Because it is summary only, proceedings must normally start within six months of the offence, which in practice makes prosecutions rare. |
| 5 | Civil liability | None found | None. Section 56 states that the Act confers no right of action in civil proceedings for failure to comply. The routes are internal review, complaint to the Information Commission, appeal to the First-tier Tribunal, and in narrow cases judicial review. |
| 6 | Regulatory enforcement toolkit | Asymmetry found | No monetary penalties. The regulator issues decision notices (s.50), information notices (s.51) and enforcement notices (s.52), and can make practice recommendations (s.48). Failure to comply with a notice can be certified to the High Court and dealt with as contempt (s.54). An accountable person can override certain notices by certificate (s.53). |
| 7 | Personal / director liability | Asymmetry found | The s.77 offence can be committed by the public authority itself and by any person employed by it, an officer of it or subject to its direction. Individuals are therefore directly liable; no director-liability provision is needed. |
| 8 | Public vs private sector split | Asymmetry found | Public sector only. The Act applies to bodies listed in Schedule 1, bodies designated by order under s.5 and publicly-owned companies under s.6. Private bodies are outside it unless designated, however public their functions. |
| 9 | Legal-person coverage | Asymmetry found | The right of access belongs to any person, including companies, campaign groups and journalists, not only individuals. The requester's identity and motive are generally irrelevant, except where s.14 (vexatious requests) is in play. |
| 10 | Exemptions, with their conditions | Asymmetry found | Part II sets out the exemptions, each either absolute (no public interest test) or qualified (subject to the s.2 public interest test), and either class-based or prejudice-based. Absolute exemptions include ss.21, 23, 32, 34, 41 and 44 and parts of ss.36, 37 and 40. Cost (s.12) and vexatious requests (s.14) are grounds for refusal rather than exemptions. |
Criminal liability
A distinct track, separate from the regulatory penalties below. The same failure can attract both: a penalty notice against the organisation and a prosecution of the individual.
s.77: Altering etc. records with intent to prevent disclosure
Where a request has been made and the applicant would have been entitled to the information, it is an offence for the public authority, or a person employed by it, an officer of it or subject to its direction, to alter, deface, block, erase, destroy or conceal any record held by the authority with the intention of preventing its disclosure. The FOI counterpart of DPA 2018 s.173.
- Mens reaMens reaThe mental element an offence requires, such as intention, knowledge or recklessness. Most DPA 2018 offences need knowledge or recklessness.Defined in: General criminal law
- Intention to prevent disclosure
- Penalty
- Fine not exceeding level 5 on the standard scale (unlimited in England and Wales); summary only
- Imprisonment
- Not available
Civil liability
The Act confers no right of action in civil proceedings (s.56). A dissatisfied requester asks for an internal review, then complains to the Information Commission, then appeals to the First-tier Tribunal.
- s.50 complaint to the regulator
Information Commission : Normally only after the authority's internal review.
- s.57 appeal
First-tier Tribunal (General Regulatory Chamber) : Either party may appeal a decision notice.
Regulatory enforcement
- Penalty ceiling
- No monetary penalties. Non-compliance with a notice is certified to the High Court and dealt with as contempt (s.54).
- Decision notice s.50
Decides a complaint and can require disclosure.
- Information notice s.51
Requires the authority to provide information for an investigation.
- Enforcement notice s.52
Requires steps to comply with Part I.
- Practice recommendation s.48
Recommends steps to conform with the s.45 and s.46 codes.
- Certification to the High Court s.54
Non-compliance dealt with as contempt of court.
An accountable person (for government departments, a Cabinet minister) can by certificate exempt the authority from complying with certain decision or enforcement notices (s.53), subject to judicial review.
Personal / director liability
- Available
- Yes
- Basis
- s.77(2)
Employees, officers and anyone subject to the authority's direction can be prosecuted personally under s.77.
Legal-person coverage
- Covers legal persons
- Yes
Any person may make a request, including companies and other legal persons. The Act protects access, not the requester's own data.
Public / private sector split
- Separate regimes
- Yes
Public authorities only, defined by list and designation rather than by function.
- Schedule 1
Listed public authorities: government departments, local authorities, NHS bodies, schools, police and many others.
- s.5 designation
Bodies designated by order because they exercise functions of a public nature or provide services under contract with a public authority.
- s.6
Companies wholly owned by the Crown or by public authorities.
Exemptions
Recorded with their trigger conditions, not as bare names, most are conditional tests applied case by case rather than blanket carve-outs.
s.21, Information accessible by other means
Trigger
Absolute. Applies where the information is reasonably accessible to the applicant otherwise than under the Act, for example already published.
Disapplies
- s.1(1)(b) duty to communicate
s.22, Information intended for future publication
Trigger
Qualified, class-based. The information is held with a view to publication at a future date, and it is reasonable in all the circumstances to withhold it until then.
Disapplies
- s.1(1)(b)
s.22A, Research
Trigger
Qualified, prejudice-based. Information obtained in a continuing programme of research intended for publication, where disclosure before then would, or would be likely to, prejudice the programme, the researcher's interests or the authority's interests.
Disapplies
- s.1(1)(b)
s.23, Information supplied by, or relating to, bodies dealing with security matters
Trigger
Absolute, class-based. Information directly or indirectly supplied by, or relating to, the bodies listed in s.23(3), such as the security and intelligence agencies.
Disapplies
- s.1(1)(a) and (b)
s.24, National security
Trigger
Qualified. Applies where exemption is required for the purpose of safeguarding national security. A Minister's certificate is conclusive evidence, subject to appeal.
Disapplies
- s.1(1)(a) and (b)
s.26, Defence
Trigger
Qualified, prejudice-based. Disclosure would, or would be likely to, prejudice the defence of the British Islands or the capability or security of the armed forces.
Disapplies
- s.1(1)(a) and (b)
s.27, International relations
Trigger
Qualified, prejudice-based, or class-based for confidential information obtained from another State or an international organisation.
Disapplies
- s.1(1)(a) and (b)
s.28, Relations within the United Kingdom
Trigger
Qualified, prejudice-based. Disclosure would, or would be likely to, prejudice relations between administrations in the UK.
Disapplies
- s.1(1)(a) and (b)
s.29, The economy
Trigger
Qualified, prejudice-based. Disclosure would, or would be likely to, prejudice the economic interests of the UK or the financial interests of a UK administration.
Disapplies
- s.1(1)(a) and (b)
s.30, Investigations and proceedings conducted by public authorities
Trigger
Qualified, class-based. Information held for criminal investigations or proceedings, or obtained from confidential sources for certain investigations.
Disapplies
- s.1(1)(a) and (b)
s.31, Law enforcement
Trigger
Qualified, prejudice-based. Disclosure would, or would be likely to, prejudice the prevention or detection of crime, the administration of justice, tax collection or other listed functions. Only where s.30 does not apply.
Disapplies
- s.1(1)(a) and (b)
s.32, Court records
Trigger
Absolute, class-based. Information held only by virtue of being in documents filed with, or created by, a court or tribunal for proceedings.
Disapplies
- s.1(1)(a) and (b)
s.33, Audit functions
Trigger
Qualified, prejudice-based. Applies to authorities with audit functions where disclosure would, or would be likely to, prejudice those functions.
Disapplies
- s.1(1)(a) and (b)
s.34, Parliamentary privilege
Trigger
Absolute. Exemption is required to avoid an infringement of the privileges of either House. A certificate from the Speaker or Clerk is conclusive.
Disapplies
- s.1(1)(a) and (b)
s.35, Formulation of government policy
Trigger
Qualified, class-based. Information held by a government department relating to the formulation or development of government policy, ministerial communications, Law Officers' advice or a ministerial private office.
Disapplies
- s.1(1)(a) and (b)
s.36, Prejudice to effective conduct of public affairs
Trigger
Qualified, except for information held by either House of Parliament. Engaged only where, in the reasonable opinion of a qualified person, disclosure would, or would be likely to, prejudice the matters listed. The opinion must be reasonable and actually given.
Disapplies
- s.1(1)(a) and (b)
s.37, Communications with Her Majesty and honours
Trigger
Absolute for communications with the Sovereign, the heir and the second in line; qualified for other members of the Royal Family and Household and for honours.
Disapplies
- s.1(1)(a) and (b)
s.38, Health and safety
Trigger
Qualified, prejudice-based. Disclosure would, or would be likely to, endanger the physical or mental health or safety of any individual.
Disapplies
- s.1(1)(a) and (b)
s.39, Environmental information
Trigger
Qualified, class-based. Applies to information the authority must make available under the EIR, so the request is handled under the EIR instead.
Disapplies
- s.1(1)(a) and (b)
In practice a routing provision rather than a reason to withhold.
s.40(1), Personal information about the requester
Trigger
Absolute. The information is the requester's own personal data. Handled as a subject access request instead.
Disapplies
- s.1(1)(a) and (b)
s.40(2), Personal information about someone else
Trigger
Absolute where disclosure to the public would contravene the data protection principles (the first condition); otherwise conditions linked to the data subject's rights apply, some subject to the public interest test.
Disapplies
- s.1(1)(b)
Disclosure under FOIA is treated as disclosure to the world, which is why the principles test is usually decisive.
s.41, Information provided in confidence
Trigger
Absolute. The information was obtained from another person and disclosure would constitute an actionable breach of confidence. A public interest defence to the breach of confidence is built into that test.
Disapplies
- s.1(1)(b)
s.42, Legal professional privilege
Trigger
Qualified, class-based. Information in respect of which a claim to legal professional privilege could be maintained in legal proceedings. The public interest in maintaining privilege carries substantial inherent weight.
Disapplies
- s.1(1)(a) and (b)
s.43, Commercial interests
Trigger
Qualified. Trade secrets (class-based), or information whose disclosure would, or would be likely to, prejudice the commercial interests of any person, including the authority.
Disapplies
- s.1(1)(a) and (b)
s.44, Prohibitions on disclosure
Trigger
Absolute. Disclosure is prohibited by or under another enactment, incompatible with an obligation the statute preserves, or would be contempt of court.
Disapplies
- s.1(1)(a) and (b)
s.12, Cost of compliance exceeds the appropriate limit
Trigger
Not an exemption: a ground for refusal. Applies where the estimated cost of complying exceeds the appropriate limit set in the fees regulations. Advice and assistance on narrowing the request should be offered (s.16).
Disapplies
- s.1(1)
s.14, Vexatious or repeated requests
Trigger
Not an exemption: a ground for refusal. The request is vexatious (judged on the request, not the requester, though context and history count), or repeats an identical or substantially similar request without a reasonable interval.
Disapplies
- s.1(1)
Interactions and conflicts
The cross-instrument texture that profiling an Act in isolation misses, including where the real answer to a question about this Act is found in a different one.
| Instrument | Relationship | Note |
|---|---|---|
| Environmental Information Regulations 2004 | Cross-reference | Section 39 sends environmental information to the EIR. Where both could apply, the EIR govern and its narrower exceptions and presumption in favour of disclosure apply. |
| Data Protection Act 2018 | Reads with | Section 40 applies the data protection regime to personal information. FOIA s.77 and DPA s.173 are parallel offences for FOI and subject access requests respectively. |
| UK GDPR | Reads with | The s.40(2) first condition asks whether disclosure would contravene the Art 5(1)(a) principle, usually through an Art 6(1)(f) style analysis. |
| Freedom of Information (Scotland) Act 2002 | Cross-reference | Scottish public authorities are under FOISA, not FOIA. UK-wide authorities stay under FOIA even for information about Scotland. |
Questions answered
The questions this instrument most often raises, with the answer and the authority for it.
-
How long is there to prosecute under s.77?
Six months from the offence in England and Wales. Section 77 is summary only, so proceedings must start within six months of the alteration or destruction (Magistrates' Courts Act 1980 s.127), and the Act has never been amended to change that. Because destruction is often discovered later, the practical answer is to report suspected destruction to the regulator straight away. Scotland is different: FOISA s.65A allows six months from when the prosecutor has sufficient evidence, up to three years after the offence. Convictions are recorded on the enforcement page.
-
Can a minister veto disclosure after Evans?
Only within narrow limits, set by R (Evans) v Attorney General [2015] UKSC 21. Against a tribunal or court decision, a s.53 certificate cannot rest on the accountable person simply taking a different view of the same facts and arguments (Lord Neuberger, with Lords Kerr and Reed); Lord Mance and Lady Hale required the clearest possible justification to disagree with findings of fact or law, and properly explained, solid reasons to weigh the public interest differently. Against a decision notice of the regulator alone the constraint is less strict, but the government is expected to appeal instead, and a certificate on grounds that could have been argued on appeal will often be a misuse of the power (paras 80 to 83). A certificate is open to judicial review. In the same case the Supreme Court held the equivalent power for environmental information, EIR reg 18(6), invalid.
Tools, maps and checklists for this instrument
Which access regime applies?
Route an information request to the right law and regulator: subject access, FOIA, EIR, FOISA or the Scottish EIR.
FOI request response (FOIA 2000)
Work an FOI request to a public authority in England, Wales or Northern Ireland, or a UK-wide authority, from receipt to appeal.
Explainers
- What is a freedom of information request, and how long does an authority have?FOI request
- Who counts as a public authority for FOI and the EIR?Public authorities
- What is the public interest test in FOI?Public interest test
- What does "neither confirm nor deny" mean?Neither confirm nor deny
- When can an authority refuse an FOI request on cost?Cost limit
- What is a vexatious request?Vexatious requests
- What is an internal review, and when must an authority carry one out?Internal review
- What is a publication scheme, and who needs one?Publication scheme
- Does FOIA or FOISA apply to a Scottish body?FOIA or FOISA
- How do you complain or appeal about an FOI response?Complaints and appeals
Activities this instrument governs
| Activity | Role here | Provisions |
|---|---|---|
| Requests for a person's own data | Interacts | s.40(1) |
| FOI requests for someone else's personal data | Primary | s.40(2) |
| Requests for environmental information | Interacts | s.39 |
| Workplace monitoring and CCTV | Interacts | s.40 |
| Public sector data sharing | Interacts | Part I |
Codes of practice and guidance
- Code of practice on the discharge of public authorities' FOI functionsStatutory code, FOIA 2000 s.45
- Code of practice on the management of recordsStatutory code, FOIA 2000 s.46
Regulators, tribunals and prosecutors
- Information CommissionUK-wide regulator for data protection and PECR, and for FOIA 2000 and EIR 2004. Succeeded the Information Commissioner on 2026-09-30.
- First-tier Tribunal (General Regulatory Chamber)Hears information rights appeals against the regulator's notices and decisions.
- Upper Tribunal (Administrative Appeals Chamber)Appeals from the First-tier Tribunal on points of law in information rights cases.
Sources
- Primary Magistrates' Courts Act 1980, section 127 legislation.gov.uk
- Secondary Time limit for prosecutions under s.77 of the FOI Act Campaign for Freedom of Information
- Primary Freedom of Information (Scotland) Act 2002, section 65A legislation.gov.uk
- Case law R (Evans) v Attorney General [2015] UKSC 21 The National Archives (Find Case Law)
- Primary Freedom of Information Act 2000 (c. 36) legislation.gov.uk
- Primary Freedom of Information Act 2000, section 77 legislation.gov.uk
- Regulator First-tier Tribunal (General Regulatory Chamber) GOV.UK
- Regulator Section 45 code of practice, request handling Information Commission (ICO guidance)
Updated