Data Governance Atlas UK edition

Which access regime applies?

Decision tool Freedom of information

Route an information request to the right law and regulator: subject access, FOIA, EIR, FOISA or the Scottish EIR.

    Is the requester asking for information about themselves?

    Yes, their own personal data No, or not only

    Subject access

    Handle it as a subject access request under the UK GDPR, wherever the organisation is in the UK. A public authority does not treat it as FOI.

    Basis: UK GDPR Art 15; FOIA 2000 s.40(1); FOISA 2002 s.38

    Subject access requests procedure Subject access: intake and stop-the-clock assessment checklist

    Who holds the information?

    A Scottish public authority A public authority in England, Wales or Northern Ireland, or a UK-wide authority A private company or charity that is not a public authority

    Is it environmental information?

    About the state of the environment, emissions, land use or measures affecting them. The requester does not choose.

    Yes No

    Is it environmental information?

    Yes No

    EIR 2004

    Environmental Information Regulations 2004, regulated by the Information Commission. 20 working days, extendable to 40 for complex and voluminous requests.

    Basis: EIR 2004 regs 5 and 7

    EIR 2004 profile EIR request response (EIR 2004) procedure EIR request response (EIR 2004) checklist

    FOIA 2000

    Freedom of Information Act 2000, regulated by the Information Commission. 20 working days, excluding bank holidays anywhere in the UK.

    Basis: FOIA 2000 ss.1 and 10

    FOIA 2000 profile FOI request response (FOIA 2000) procedure FOI request response (FOIA 2000) checklist

    EIRS 2004

    Environmental Information (Scotland) Regulations 2004, regulated by the Scottish Information Commissioner.

    Basis: EIRS 2004

    EIRS 2004 profile Scottish FOI and EIR response (FOISA 2002, EIRS 2004) procedure Scottish FOI and EIR response (FOISA 2002, EIRS 2004) checklist

    FOISA 2002

    Freedom of Information (Scotland) Act 2002, regulated by the Scottish Information Commissioner. 20 working days, excluding Scottish bank holidays.

    Basis: FOISA 2002 ss.1 and 10

    FOISA 2002 profile Scottish FOI and EIR response (FOISA 2002, EIRS 2004) procedure Scottish FOI and EIR response (FOISA 2002, EIRS 2004) checklist

    No general right of access

    FOI does not apply to private bodies. If the information is about the requester, subject access applies. Otherwise there is no general statutory route.

    Basis: FOIA 2000 s.3; UK GDPR Art 15

    Subject access requests procedure

    Sources