Freedom of information and data protection

Freedom of information (FOI) gives you the right to ask any public sector organisation for information they hold. Anyone can request information. You can also ask for information about yourself under data protection legislation.

Organisations you can ask for information from

You can ask for information from publicly-funded organisations that work for the welfare of the whole population, such as:

  • government departments
  • local councils
  • schools, colleges and universities
  • health trusts, hospitals and doctors’ surgeries
  • publicly-funded museums
  • the police
  • non-departmental public bodies, committees and advisory bodies

Making an FOI request

You can contact an organisation directly by letter or email to make a freedom of information request. When making your request, you should include:

  • your name
  • an address where you can be contacted
  • a detailed description of the recorded information you want
  • the format you want the information in

You can ask for the information in a number of different formats. This could be paper or electronic copies of any original documents, or alternative formats like large print, audio format or Braille.

Depending on the nature of your request, you can ask for all the information or just a summary.

If you plan to reproduce the information you receive, make sure you check the copyright status of it first.

Most requests are free but you might be asked to pay a small amount for photocopies or postage. You will be told by the organisation if you have to pay anything.

You should receive the information within 20 working days. If the organisation needs more time, they will contact you and tell you when you can expect the information.

Find out more about accessing information from a public body.

If your request is turned down

Some sensitive information might not be available to members of the public. If this is the case, the organisation must tell you why they have withheld some or all of the information you requested.

An organisation can turn down your request if they think it will cost them more than £450.00 (£600.00 for a central government organisation) to deal with your request.

They might then ask you to be more specific so they can provide the information you’re looking for.

If an organisation doesn’t give you the information you asked for, you should first contact them and ask them to review their decision.

If you're still not satisfied, you can complain to the Information Commissioner’s Office.

Data protection

General Data Protection Regulation (GDPR) and data protection laws control how your personal information is used by organisations, businesses or the government.

Everyone who collects data has to follow strict rules called ‘data protection principles’. They must make sure the information is:

  • processed  lawfully, fairly and in a transparent way
  • collected for written, explicit and legitimate purposes
  • adequate, relevant and limited to what is necessary for the purposes for which it is processed
  • accurate and kept up-to-date
  • kept for no longer than is absolutely necessary
  • processed in a safe and secure way

There is stronger legal protection for more sensitive information, such as:

  • race
  • ethnic origin
  • political opinions
  • religious or philosophical beliefs
  • trade union membership
  • genetics
  • biometrics (when used for ID purposes, such as facial recognition or fingerprints)
  • health
  • sex life
  • sexual orientation

Your data protection rights

You have the following rights under data protection legislation:

  • the right to be informed
  • the right of access
  • the right to rectification
  • the right to erasure
  • the right to restrict processing
  • the right to data portability
  • the right to object
  • rights about automated decision making and profiling

Further information on all of the above rights is available through the ICO website.

If you wish to use any of the rights above, you should contact the relevant organisation. Contacts for each department are:

Right of access

The right of access means that you have the right to get:

  • confirmation that your data is being processed lawfully
  • access to your personal data
  • other extra information, for example information that should be provided in a privacy notice

The organisation is legally required to give you a copy of the information they hold about you if you ask for it.

A copy of the information should be provided free of charge. However, organisations can charge a ‘reasonable fee’ in specific circumstances.

Withheld information

There are some situations when organisations are allowed to withhold information, for example if the information is about:

  • the prevention, detection or investigation of a crime
  • national security or the armed forces
  • the assessment or collection of tax
  • judicial or ministerial appointments
  • statistics and scientific or historical research

An organisation doesn’t have to say why they are withholding information.

Worried about your data

If you think your data has been misused or that the organisation holding it hasn’t kept it secure, you should contact them and tell them.

If you are unhappy with their response, or if you need any advice, you should contact the Information Commissioner’s Office (ICO).

The ICO can investigate your claim and take action against anyone who has misused personal data. You can also visit their website for information on how to make a data protection complaint.

The Information Commissioner's Office (ICO)

The Information Commissioner's Office (ICO) can help you understand what data protection, freedom of information and related issues mean to you. It can advise you on how to protect your personal information and how to gain access to official records.

If you think an organisation has failed to abide by the legislation the ICO regulates, you may be able to get help.

You can find out how to make a complaint and more on the ICO website.

Share this page

Feedback

Would you like to leave feedback about this page? Send us your feedback