Skip to main content

Create a formal Freedom of Information (FOI) request letter under the Freedom of Information Act 2000. Compliant with s.8 FOIA 2000, covering the 20-working-day response period, exemptions (absolute and qualified), Environmental Information Regulations 2004, and your right to internal review and ICO complaint.

What Is a Freedom of Information Request (England & Wales)?

A Freedom of Information (FOI) request is a formal written application made to a public authority under section 1 of the Freedom of Information Act 2000 (FOIA 2000), asking the authority to confirm whether it holds specified information and, if so, to disclose that information to the requester. The FOIA 2000 came fully into force on 1 January 2005 and represents one of the most significant transparency reforms in modern UK constitutional history. It applies to all public authorities listed in Schedule 1 to the Act and those designated by Order under s.5 FOIA 2000, including every government department from the Cabinet Office to HMRC, all local councils, NHS trusts and clinical commissioning groups, maintained schools, universities, the police, fire services, publicly owned companies, and Parliament itself.

The right of access created by s.1(1) FOIA 2000 is universal: any person — individual, company, or organisation, regardless of nationality or residence — may make an FOI request and has the right to receive the information held unless a specific statutory exemption applies. The requester is not required to explain their reasons for wanting the information, and the authority cannot refuse simply because it considers the purpose inconvenient, embarrassing, or commercially sensitive, unless a relevant exemption is engaged. The Act creates two parallel duties on public authorities: the duty to confirm or deny whether the information is held (s.1(1)(a)), and the duty to communicate the information if it is held (s.1(1)(b)).

FOI requests must comply with the formal requirements of s.8 FOIA 2000: the request must be in writing (which includes email), state the requester’s real name, provide an address for correspondence (which may be an email address), and describe the information requested with sufficient clarity for the authority to identify it. Beyond these requirements, no other formality is needed. The FOIA 2000 operates alongside the Environmental Information Regulations 2004 (SI 2004/3391), which implement the Aarhus Convention and provide a parallel access regime for environmental information that is generally more permissive than the FOIA 2000 itself. Where information falls within the EIR 2004, the authority should apply that regime rather than the FOIA 2000.

The Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 govern the cost limits (£450 or £600) above which authorities may refuse requests under s.12 FOIA 2000, and the fees they may charge for disbursements where they do comply. The Information Commissioner’s Office (ICO) is the independent regulator of the FOIA 2000 and has power under s.50 FOIA 2000 to issue decision notices enforceable by the High Court.

When Do You Need a Freedom of Information Request (England & Wales)?

You should use this Freedom of Information request template whenever you need information from a public authority and believe that authority is subject to the Freedom of Information Act 2000 or the Environmental Information Regulations 2004. FOI requests are an important tool for journalists, researchers, campaigners, businesses, lawyers, and private individuals seeking accountability and transparency from publicly funded bodies.

Typical situations where an FOI request is appropriate include: journalists investigating public spending, procurement decisions, or policy-making; researchers seeking data for academic studies on public services, crime, health, or the environment; businesses wishing to understand regulatory decisions, planning history, or the basis of procurement awards; lawyers seeking documents relevant to litigation or regulatory proceedings; tenants and homeowners seeking planning decisions, inspection reports, or housing authority records; patients seeking information about NHS decisions on service provision or treatment protocols; local residents investigating council spending, planning permissions, or regulatory enforcement; and any person wishing to understand how a public authority has reached a decision that affects them.

You should also use this template — or be aware of its limitations — in the following circumstances. If the information concerns your own personal data, the correct mechanism is a Subject Access Request (SAR) under Article 15 of the UK GDPR and s.45 of the Data Protection Act 2018, not an FOI request; the authority is entitled to refuse an FOI request for the requester’s own personal data under s.40(1) FOIA 2000. If the information relates to the environment (pollution levels, planning applications, environmental permits, ecological surveys), consider requesting it under the Environmental Information Regulations 2004 instead of or in addition to the FOIA 2000, as the EIR 2004 exceptions are narrower and the presumption in favour of disclosure is stronger. If the authority is a private company that is not publicly owned, the FOIA 2000 does not apply; however, companies that deliver public functions under contract (such as private prisons or outsourced local authority services) may be subject to the Act in relation to those functions. In those cases, the request should be directed to the public authority that commissioned the service.

A well-drafted FOI request specifying a clear date range, identifiable document types, and a defined subject matter is far more likely to receive a prompt, substantive response than a broad or vague request that engages the s.12 cost limit or requires extensive clarification under s.1(3) FOIA 2000.

What to Include in Your Freedom of Information Request (England & Wales)

A properly drafted Freedom of Information request under the FOIA 2000 contains several key elements that together maximise the likelihood of a prompt and complete response. The first element is the requester’s identification: a valid request under s.8(1)(b) FOIA 2000 must state the requester’s real name and provide a correspondence address, which may be an email address. Anonymous requests are not valid under the FOIA 2000, although the Information Commissioner’s Office has issued guidance that pseudonymous requests may be valid if the pseudonym provides a sufficient means of identification.

The second key element is the identification of the correct public authority. The request must be directed to the authority that actually holds the information; a request sent to the wrong body does not trigger the 20-working-day response period. Under s.15 FOIA 2000, an authority that receives a request but does not hold the information should, if possible, advise the requester of the correct authority. Checking the Schedule 1 list and the ICO’s online public authority register before sending the request saves time.

The third and most important element is the description of the information requested. This must describe the information clearly enough for the authority to identify it. The description should specify: the subject matter; the relevant date range; the type of documents sought (emails, minutes, reports, contracts, data sets); and any reference numbers, project names, or department names that will help narrow the search. Overly broad descriptions covering entire policy areas without date limits are the single most common reason requests are refused under s.12 FOIA 2000 (cost limit) or are delayed while the authority seeks clarification under s.1(3).

The fourth element is a reference to the 20-working-day response deadline under s.10(1) FOIA 2000. Including this in the letter puts the authority on notice from the outset of its statutory obligation to respond promptly. The fifth element is the format preference under s.11 FOIA 2000: specifying whether you want the information by email, in hard copy, or available for inspection at the authority’s offices ensures the authority fulfils its obligation to give effect to your preference so far as reasonably practicable.

The sixth element is the request for explanation of exemptions. If the authority intends to rely on a qualified exemption under Part II FOIA 2000, it must conduct a public interest balancing test under s.2(2)(b) and set out the factors weighed. Expressly requesting this explanation in the letter enables you to assess the adequacy of the authority’s reasoning and to challenge it effectively on internal review or before the ICO. The seventh element is the reference to the Environmental Information Regulations 2004, which is important where the requested information may relate to environmental matters and ensures the more permissive EIR 2004 regime is applied where appropriate. The eighth element is a clear statement of your right to internal review and to complain to the ICO, which signals to the authority that you are aware of the enforcement framework and intend to use it if necessary.

Frequently Asked Questions

Related Documents

You may also find these documents useful:

GDPR Data Breach Notification Form (England & Wales)

Create a comprehensive UK GDPR Data Breach Notification Form compliant with Articles 33 and 34 of the UK General Data Protection Regulation and Section 108 of the Data Protection Act 2018. This template covers mandatory ICO notification within the 72-hour window, data subject communication obligations, breach classification (confidentiality, integrity, availability), categories of personal data affected, scale assessment, risk evaluation, remediation measures, and cross-border supervisory authority notifications under the NIS Regulations 2018. Suitable for data controllers of all sizes operating in England and Wales. Download as PDF or Word.

Data Protection Impact Assessment (DPIA) — UK GDPR (England & Wales)

Create a comprehensive Data Protection Impact Assessment (DPIA) fully compliant with UK GDPR Article 35, Article 36 prior consultation, and the Data Protection Act 2018 for England and Wales. This template covers all mandatory DPIA elements: systematic processing description (nature, scope, context, purpose), lawful basis under Article 6, special category Article 9(2) conditions, data subject categories, automated decision-making assessment under Article 22, third-party processor identification with Article 28 DPA status, international transfer mechanisms including UK IDTA, necessity and proportionality assessment, structured risk identification and assessment matrix, risk mitigation measures, residual risk evaluation, DPO consultation under Article 35(2), ICO prior consultation decision under Article 36, and formal approval with dual signatures. Suitable for processing activities involving new technologies, large-scale monitoring, profiling, biometric data, and other high-risk processing. Download as PDF or Word.

Employee Privacy Notice — UK GDPR (England & Wales)

Create a legally compliant Employee Privacy Notice for England and Wales that satisfies the mandatory transparency obligations under UK GDPR Articles 13 and 14 and the Data Protection Act 2018. This template covers all required disclosures: data controller identity, DPO contact details, categories of employee data collected, lawful basis for processing (including Article 6 and Article 9 conditions), special category data handling, data sharing with third parties, international transfer safeguards using the UK IDTA, retention periods aligned with HMRC and Employment Rights Act 1996 requirements, automated decision-making disclosure, full data subject rights, and the right to complain to the ICO. Compliant with the ICO Employment Practices Code. Download as PDF or Word.

Letter Before Action — Demand for Payment (UK)

Create a formal Letter Before Action (demand letter) for England and Wales compliant with the Pre-Action Protocol for Debt Claims under the Civil Procedure Rules. Required before issuing County Court proceedings. Covers principal debt, statutory interest under the Late Payment of Commercial Debts Act 1998, 30-day response period, alternative dispute resolution proposal, and warning of CCJ consequences. Download as PDF or Word.

Data Retention Policy (UK)

Create a comprehensive Data Retention Policy for England and Wales that supports compliance with the UK GDPR storage limitation principle (Article 5(1)(e)) and the Data Protection Act 2018. This template covers all essential elements: organisation identification, policy scope, a detailed retention schedule by data category (employee records, payroll and PAYE, recruitment, health and safety, CCTV, customer records, contracts, and financial records), legal retention requirements under the Companies Act 2006, Income Tax (Earnings and Pensions) Act 2003, HMRC guidance, Limitation Act 1980, RIDDOR 2013, and COSHH Regulations 2002. Includes secure destruction procedures, legal hold provisions, review and audit obligations, responsibilities, and breach consequences. Download as PDF or Word.