Freedom of Information and Data Protection: FOIA 2000, UK GDPR, and the Data Protection Act 2018

Freedom of Information and Data Protection: FOIA 2000, UK GDPR, and the Data Protection Act 2018

Access to information and the protection of personal data are two essential components of modern public law. The first enables individuals, journalists, researchers and organisations to examine information held by public authorities. The second establishes rules governing how personal information is collected, used, stored, shared and protected. Together, these legal frameworks promote transparency, accountability and respect for individual rights.

In England and Wales, the principal legislation governing public access to recorded information is the Freedom of Information Act 2000 (FOIA). The general framework for personal data is provided by the UK General Data Protection Regulation (UK GDPR), supplemented by the Data Protection Act 2018 (DPA 2018). The Data (Use and Access) Act 2025 subsequently amended this framework, introducing changes to data protection rights, regulatory powers, recognised legitimate interests, automated decision-making and organisational procedures. Its data protection reforms are now in force.

Although freedom of information and data protection are closely connected, they serve different purposes. FOIA gives members of the public a general right to request recorded information from public authorities, subject to statutory exemptions. Data protection law, by contrast, regulates the processing of information relating to identifiable individuals and gives those individuals specific rights over their personal data.

The relationship between these regimes is particularly important where a freedom of information request concerns documents containing personal information. Public authorities must balance transparency against privacy, applying the relevant statutory tests rather than assuming that either disclosure or confidentiality automatically takes priority.

This article examines the legal structure of both regimes, the rights available to individuals, the responsibilities of public authorities and private organisations, the role of the Information Commissioner’s Office and the remedies available where information rights are infringed.

1. The legal framework for information rights

The law governing information rights in England and Wales consists of several interconnected statutory regimes. They should be understood as complementary systems rather than interchangeable procedures.

The principal legislation includes:

• The Freedom of Information Act 2000, which establishes public access rights to recorded information held by public authorities.
• The Environmental Information Regulations 2004, which provide a separate access regime for environmental information.
• The UK GDPR, which establishes the general principles, lawful bases and individual rights governing personal data processing.
• The Data Protection Act 2018, which supplements the UK GDPR, establishes additional safeguards and regulates particular categories of processing.
• The Data (Use and Access) Act 2025, which amends the existing data protection framework and introduces further regulatory and procedural provisions.
• The Privacy and Electronic Communications Regulations 2003, which regulate particular forms of electronic marketing, cookies and electronic communications.

The legislation has different territorial and institutional scopes. FOIA applies across the United Kingdom, although Scotland has a separate Freedom of Information (Scotland) Act 2002 for Scottish public authorities and devolved matters. The UK GDPR and Data Protection Act 2018 apply throughout the United Kingdom, subject to their particular territorial provisions.

The Information Commissioner’s Office (ICO) is the independent regulator responsible for overseeing compliance with freedom of information and data protection legislation. It investigates complaints, issues guidance, monitors compliance and exercises statutory enforcement powers.

The distinction between access to public information and access to personal information is fundamental. A person seeking a copy of a government policy document will ordinarily use FOIA. A person seeking information about how a government department has used their own personal data will ordinarily rely on the right of access under Article 15 of the UK GDPR.

2. The Freedom of Information Act 2000

The Freedom of Information Act 2000 establishes a general right of access to recorded information held by public authorities. Its purpose is to promote openness in public administration, enable scrutiny of government decisions and allow the public to understand how public institutions exercise their powers.

The Act applies to information, not merely to documents. Information may be recorded in paper files, electronic correspondence, databases, spreadsheets, minutes, reports, photographs, audio recordings or other recorded formats. A public authority is not generally required to create new information or answer a question that would require it to formulate an opinion, although it may have to extract or compile information already held in recorded form.

The right of access under section 1

Section 1 establishes two principal rights. A person making a valid request is entitled:

• To be informed whether the public authority holds information of the description specified in the request.
• Where the information is held and no applicable exemption prevents disclosure, to have that information communicated to them.

The first obligation is commonly described as the duty to confirm or deny. The second is the duty to disclose the information, subject to the statutory exemptions and other applicable restrictions.

The right is not limited to citizens, residents or taxpayers. Any person may make a request, including a foreign national, journalist, researcher, company or organisation. A requester is not normally required to explain why the information is wanted or demonstrate a particular interest in the subject.

The request must, however, satisfy the formal requirements of section 8. It must be in writing, state the requester’s name and an address for correspondence, and describe the information sought sufficiently clearly. Requests may be submitted electronically, including by email.

A public authority should not refuse a request merely because it considers the requester’s motivation unconvincing or politically inconvenient. The statutory right is generally independent of the requester’s purpose.

Which organisations are subject to FOIA?

FOIA applies to public authorities identified in Schedule 1 and to certain other bodies designated under the Act. These include central government departments, local authorities, NHS bodies, police authorities, educational institutions and a range of other public bodies.

The Act also applies to certain publicly owned companies and organisations designated by the Secretary of State where the statutory conditions are met.

A private organisation does not become a public authority simply because it performs work of public importance. However, information held by a public authority about a private contractor may be subject to disclosure. Where a private organisation provides services for a public authority, the contractual arrangements should address how relevant information is retained and made available to the authority so that it can meet its statutory obligations.

The distinction is important in public procurement, outsourcing, healthcare provision, transport and other sectors where public functions are performed through private entities.

Information held by an authority

The relevant question is whether the public authority holds the requested information at the time the request is received. Information may be held on behalf of another person or organisation, and information held by a contractor on behalf of an authority may in some circumstances be treated as held by that authority.

A public authority is not normally required to obtain information that it does not hold. It may, however, have a duty to provide advice and assistance under section 16, including helping a requester clarify an overly broad or ambiguous request.

The authority must also consider whether information is held by another public body. It may explain which authority is likely to hold the information or, with the requester’s agreement, facilitate the transfer of the request.

The official legislation is available in the Freedom of Information Act 2000. legislation.gov.uk+1

3. Making and processing a freedom of information request

The FOIA procedure is designed to make access to public information relatively straightforward. A requester does not need to use a prescribed form, although public authorities may provide online forms to assist with the process.

A request should identify the information sought as precisely as reasonably possible. For example, a request for all documents concerning a major public procurement decision may be too broad if it covers several years, departments and categories of material. A more focused request specifying the contract, relevant period and types of documents is more likely to produce a useful response.

The public authority must consider the request according to the statutory requirements, rather than treating it as an ordinary customer-service enquiry.

The 20-working-day response period

Under section 10, the public authority must respond promptly and, in most cases, no later than 20 working days after receiving the request. The first working day after receipt is generally counted as day one.

The authority must either provide the information, confirm that it does not hold it, or issue a refusal notice explaining the legal basis for withholding it.

The 20-working-day period is not simply a period within which the authority must acknowledge the request. A holding response that does not provide the information or otherwise satisfy the statutory requirements will not ordinarily meet the obligation.

There are limited circumstances in which the statutory period may vary. For example, a public authority may need additional time to consider the public interest test for a qualified exemption. The authority must explain this to the requester and act within the applicable statutory framework. It cannot extend the deadline merely because its records are poorly organised or its staff are occupied with other matters.

Schools and certain other bodies may be subject to specific variations in the calculation of the response period.

Fees and the appropriate limit

FOIA permits public authorities to refuse a request where the cost of compliance exceeds the appropriate statutory limit.

The prescribed limits are generally:

• £600 for central government departments and certain other designated authorities.
• £450 for other public authorities.

The relevant regulations also prescribe an hourly rate of £25 for estimating staff time spent on locating, retrieving and extracting information. This corresponds to 24 hours for the £600 limit and 18 hours for the £450 limit.

The authority may take account of specified activities, such as determining whether information is held, locating relevant material, retrieving it and extracting the information. It cannot generally include every administrative cost associated with reviewing, redacting and communicating the information.

Where the cost limit is likely to be exceeded, the authority should consider whether the request can be refined so that some useful information can still be disclosed within the limit. The statutory duty to provide advice and assistance is particularly relevant in this context.

Repeated and vexatious requests

Section 14 allows an authority to refuse a request that is repeated or vexatious.

A repeated request may be refused where the same or substantially similar request has already been made by the same person, subject to the statutory conditions. A request is not necessarily repeated merely because a person asks about a related subject or seeks additional information.

A vexatious request is assessed in context. Relevant considerations may include the burden imposed on the authority, the nature and purpose of the request, the history of the correspondence and whether the request forms part of a pattern of unreasonable conduct.

The fact that a request is critical, embarrassing or politically sensitive does not make it vexatious. Authorities must be careful not to use section 14 as a means of avoiding legitimate public scrutiny.

Refusal notices and partial disclosure

Where an authority relies on an exemption, section 17 generally requires it to issue a refusal notice within the applicable response period. The notice must identify the exemption relied upon and explain why it applies, unless the explanation would otherwise be apparent.

An authority may disclose part of a requested document while withholding exempt passages. This is known as partial disclosure or redaction.

The existence of an exemption does not automatically justify withholding an entire document where the exempt information can reasonably be separated from the remainder. The authority should consider whether non-exempt material can be disclosed without compromising the protected interest.

ICO guidance on FOIA response times and handling requests explains the operational requirements. ICO+2

4. Exemptions under the Freedom of Information Act

The right of access under FOIA is broad but not absolute. Part II of the Act establishes exemptions protecting particular categories of information or interests that may be harmed by disclosure.

The exemptions reflect the need to balance transparency against other legitimate concerns, including national security, law enforcement, personal privacy, commercial confidentiality and the effective operation of public institutions.

Some exemptions are absolute, meaning that the public interest test in section 2 does not have to be applied. Others are qualified and require the authority to balance the public interest in disclosure against the public interest in maintaining the exemption.

Absolute and qualified exemptions

An absolute exemption prevents disclosure where its statutory conditions are satisfied. The authority does not have to demonstrate that withholding the information is in the public interest.

Examples include certain information accessible by other means under section 21, information supplied by security bodies under section 23, certain court records under section 32, parliamentary privilege under section 34, and information whose disclosure would constitute an actionable breach of confidence under section 41.

Qualified exemptions operate differently. Even where an exemption applies, the authority must consider whether the public interest in maintaining it outweighs the public interest in disclosure.

This distinction is central to the operation of FOIA. An authority cannot simply identify a qualified exemption and automatically withhold the information. It must conduct the required balancing exercise and explain its conclusion.

Principal exemptions

National security and defence. Sections 23 and 24 protect information relating to security bodies and national security. Section 26 concerns defence. These provisions recognise that disclosure may compromise intelligence operations, military capabilities, security arrangements or other protected interests.

International relations. Section 27 protects information where disclosure would, or would be likely to, prejudice relations between the United Kingdom and another state or international organisation. It may apply to diplomatic correspondence, negotiations and sensitive international discussions.

Law enforcement. Section 31 protects information where disclosure would, or would be likely to, prejudice specified law enforcement functions. These may include the prevention or detection of crime, the apprehension or prosecution of offenders, and the administration of justice. The exemption is qualified and requires consideration of the public interest.

Formulation of government policy. Section 35 protects certain information relating to the formulation or development of government policy, ministerial communications and other specified government matters. It recognises the importance of allowing ministers and officials to consider policy options and exchange advice. However, the exemption is qualified, and the public interest in accountability may favour disclosure, particularly once a decision has been made.

Prejudice to public affairs. Section 36 protects certain information where disclosure would, or would be likely to, prejudice the effective conduct of public affairs. Its application requires the statutory conditions to be satisfied, including the relevant opinion of a qualified person.

Commercial interests. Section 43 protects trade secrets and information where disclosure would, or would be likely to, prejudice the commercial interests of any person, including the public authority holding the information. The authority must consider whether disclosure would cause the relevant commercial harm and, for the qualified part of the exemption, whether the public interest favours withholding.

Personal information. Section 40 protects personal data. The exemption is particularly important where disclosure under FOIA would conflict with the UK GDPR or the Data Protection Act 2018. The authority must distinguish between a request for the requester’s own personal data, which is generally handled under data protection law, and a request for another person’s personal information.

Information provided in confidence. Section 41 applies where information was obtained from another person and disclosure by the authority would constitute an actionable breach of confidence. It is an absolute exemption, although the underlying law of confidence must actually be satisfied.

Legal professional privilege. Section 42 protects information in respect of which a claim to legal professional privilege could be maintained in legal proceedings. This may include confidential communications between a lawyer and client for the purpose of obtaining or providing legal advice, as well as certain communications prepared for litigation.

Information intended for future publication. Section 22 may apply where information is held with a genuine intention to publish it at a future date and withholding it until then is reasonable in all the circumstances. It does not provide a general licence to postpone disclosure indefinitely.

The complete list of exemptions appears in Part II of FOIA. Some provisions also permit an authority to refuse to confirm or deny whether it holds the information, where confirming or denying would itself disclose protected information.

The public interest test

The public interest test is a central feature of qualified exemptions. It requires the authority to identify the relevant public interests on both sides and determine which outweighs the other in the particular circumstances.

The public interest in disclosure may include:

• Promoting accountability and transparency in government.
• Enabling scrutiny of public expenditure and procurement.
• Revealing possible maladministration or misuse of public power.
• Improving public understanding of significant policy decisions.
• Supporting informed debate on matters of public importance.
• Exposing risks to public health, safety or the environment.

The public interest in withholding information may include protecting national security, preserving confidential advice, preventing harm to law enforcement operations, protecting legitimate commercial interests or safeguarding the effective conduct of public affairs.

The test is not a simple numerical exercise. The authority must consider the nature of the information, the likelihood and seriousness of the anticipated harm, the passage of time and the strength of the competing public interests.

The existence of political embarrassment or criticism is not, by itself, a legitimate reason for withholding information. Equally, the fact that disclosure would attract public attention does not necessarily mean that it must be released.

The Information Commissioner’s guidance on FOIA exemptions explains the distinction between absolute and qualified exemptions. ICO+2

5. Environmental information and the Environmental Information Regulations 2004

Requests for environmental information are generally governed by the Environmental Information Regulations 2004 (EIR), rather than FOIA.

The Regulations implement the United Kingdom’s obligations under the Aarhus Convention and the relevant European-derived framework on access to environmental information. Their purpose is to promote public access to information about the environment and encourage participation in environmental decision-making.

Environmental information is defined broadly. It may include information concerning:

• The state of environmental elements such as air, water, soil, land, landscapes and natural sites.
• Factors affecting or likely to affect the environment, including emissions, noise, energy, waste and radiation.
• Measures and activities affecting or intended to protect the environment.
• Environmental agreements, policies, legislation and plans.
• Reports on the implementation of environmental legislation.
• Human health and safety where affected by environmental conditions.
• Cultural sites and built structures insofar as they are affected by environmental elements or factors.

A request concerning air pollution, water quality, industrial emissions, environmental impact assessments or contaminated land may therefore fall within the EIR even if the requester refers to freedom of information.

Differences between FOIA and the EIR

The two regimes have similar objectives but differ in important respects.

First, an EIR request does not have to be made in writing. It may be made orally, although a written request is generally preferable where the subject is complex or a record of the request may be needed.

Second, the EIR does not contain the same fixed statutory cost limits as FOIA. A request may be refused where it is manifestly unreasonable, including where the burden of complying would be disproportionate, but the authority must assess the circumstances rather than simply apply the FOIA monetary thresholds.

Third, the EIR contains its own exceptions. These include protection of international relations, national defence, public security, the course of justice, intellectual property, personal data and commercial confidentiality. Most exceptions are subject to a public interest test, and the Regulations generally require a presumption in favour of disclosure.

The ordinary response period is 20 working days. Where a request is particularly complex or voluminous, the period may be extended by up to a further 20 working days, provided the requester is informed and the statutory requirements are met.

The distinction between FOIA and EIR is not optional. Public authorities must identify the correct regime according to the substance of the information requested, rather than the terminology used by the requester.

The Environmental Information Regulations 2004 provide the statutory framework.

6. The UK GDPR and the Data Protection Act 2018

The UK GDPR establishes the general legal framework for processing personal data in the United Kingdom. It is supplemented by the Data Protection Act 2018, which provides additional rules, safeguards, exemptions and enforcement provisions.

The term processing has a broad meaning. It includes collecting, recording, organising, storing, adapting, retrieving, consulting, using, disclosing, sharing, restricting, erasing or destroying personal data.

The framework applies to public authorities, private companies, charities, employers, educational institutions, healthcare providers and other organisations that process personal data within its scope.

What is personal data?

Personal data means information relating to an identified or identifiable living individual. Identification may be direct or indirect and may result from combining different pieces of information.

Examples include:

• Names, addresses and contact details.
• Identification numbers and account information.
• Employment and educational records.
• Financial and transaction information.
• Online identifiers and certain location information.
• Medical and health records.
• Photographs and recordings where an individual can be identified.
• Opinions or assessments relating to an identifiable individual.

Information does not have to contain a person’s name to qualify as personal data. An employee number, device identifier or combination of personal characteristics may be sufficient if it enables the individual to be identified by means reasonably likely to be used.

Information about a company as a legal entity is not, merely by being commercially confidential, personal data. However, information about a sole trader, director, employee or identifiable customer may qualify.

Special category data

Article 9 of the UK GDPR identifies categories of personal data requiring additional protection because of their sensitive nature. These include information revealing:

• Racial or ethnic origin.
• Political opinions.
• Religious or philosophical beliefs.
• Trade union membership.
• Genetic data.
• Biometric data processed for the purpose of uniquely identifying an individual.
• Data concerning health.
• Data concerning a person’s sex life or sexual orientation.

The processing of special category data is generally prohibited unless a specific condition under Article 9 applies. In addition, the controller must identify an appropriate lawful basis under Article 6.

The Data Protection Act 2018 supplements these requirements by establishing further conditions and safeguards for particular forms of processing, especially where substantial public interest, employment, healthcare, legal claims or other specified purposes are involved.

Criminal offence data is subject to separate safeguards under Article 10 of the UK GDPR and the relevant provisions of the DPA 2018. It includes information about criminal convictions, offences and related security measures, as well as certain information about alleged offences and criminal proceedings.

An organisation cannot assume that a general business interest or ordinary consent is sufficient to justify processing sensitive information. The additional statutory conditions must be satisfied. ICO+2

7. The six data protection principles

Article 5 of the UK GDPR establishes six fundamental principles governing personal data processing. These principles form the foundation of the entire data protection framework.

Lawfulness, fairness and transparency

Personal data must be processed lawfully, fairly and transparently.

Lawfulness requires an organisation to identify a valid legal basis for processing. Fairness requires it to avoid processing that is misleading, unduly harmful or unjustifiably detrimental to the individual. Transparency requires individuals to receive clear information about how and why their data is used.

An organisation should not collect information for an undisclosed purpose and subsequently use it in a manner that individuals could not reasonably expect without identifying an appropriate legal justification.

Purpose limitation

Personal data must be collected for specified, explicit and legitimate purposes. It must not subsequently be processed in a manner incompatible with those purposes.

For example, information collected to administer an employment relationship cannot automatically be used for unrelated commercial profiling. Further processing may be lawful in certain circumstances, including where it is compatible with the original purpose or supported by another legal provision.

Data minimisation

Organisations must collect and process only personal data that is adequate, relevant and limited to what is necessary for the intended purpose.

The principle does not prohibit the collection of information simply because it might become useful. It requires a genuine relationship between the information collected and the purpose for which it is processed.

A business collecting customer information to deliver a product, for example, should not automatically require extensive personal details that have no reasonable connection with the transaction.

Accuracy

Personal data must be accurate and, where necessary, kept up to date. Organisations must take reasonable steps to rectify or erase inaccurate information without undue delay.

Accuracy is especially important where data is used to make decisions concerning employment, creditworthiness, insurance, healthcare, education or access to public services.

Storage limitation

Personal data must not be kept in identifiable form for longer than necessary for the purposes for which it is processed.

Organisations should establish retention periods, review stored information and securely delete or anonymise data when it is no longer required, subject to legal retention obligations and legitimate exceptions.

Integrity and confidentiality

Personal data must be processed using appropriate technical and organisational measures to protect against unauthorised or unlawful processing, accidental loss, destruction or damage.

This includes appropriate access controls, encryption where suitable, secure storage, staff training, system monitoring, backup procedures and incident response arrangements.

Accountability

The controller is responsible for complying with the principles and must be able to demonstrate compliance. This is the accountability requirement in Article 5(2).

An organisation should therefore maintain appropriate policies, records, assessments, contractual arrangements and internal procedures. Compliance is not established merely by asserting that the organisation takes privacy seriously.

The six principles apply throughout the processing lifecycle. An organisation must consider them when designing a system, collecting information, sharing it with third parties, retaining it and eventually deleting it. ICO+2

8. Lawful bases for processing personal data

Article 6 of the UK GDPR requires a controller to identify at least one lawful basis for processing ordinary personal data. Consent is only one possible basis and is not automatically required for every use of personal information.

The choice of lawful basis must reflect the actual purpose and circumstances of the processing. An organisation should identify the appropriate basis before processing begins and explain it to individuals through its privacy information.

The UK GDPR, as amended by the Data (Use and Access) Act 2025, recognises seven relevant bases.

Consent. The individual has given freely given, specific, informed and unambiguous consent to the processing. Where consent is the lawful basis, the individual must be able to withdraw it. Consent is not freely given where the individual has no genuine choice or faces inappropriate pressure.

Contract. Processing is necessary for the performance of a contract with the individual or to take steps requested by that individual before entering into a contract. A company may rely on this basis to process delivery information needed to fulfil an order.

Legal obligation. Processing is necessary for compliance with a legal obligation to which the controller is subject, other than an obligation arising merely from a contract. Examples may include statutory tax, accounting or employment record requirements.

Vital interests. Processing is necessary to protect the vital interests of an individual or another person, particularly in circumstances involving serious threats to life or physical safety.

Public task. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This basis is particularly relevant to public bodies exercising statutory functions.

Legitimate interests. Processing is necessary for the legitimate interests pursued by the controller or a third party, except where those interests are overridden by the individual’s interests, rights or freedoms. This basis requires an assessment of necessity and balancing. It is not available to public authorities when processing in the performance of their public tasks.

Recognised legitimate interests. The Data (Use and Access) Act 2025 introduced a statutory category of recognised legitimate interests. It permits processing for specified purposes without the ordinary balancing test associated with the general legitimate-interests basis, provided the statutory conditions are satisfied. The purposes include certain public-interest activities, such as crime prevention, safeguarding and other specified functions. It is not a general exemption from the data protection principles or the remaining legal requirements.

A controller must not select a lawful basis simply because it is convenient. For example, an organisation cannot rely on contract where the processing is not objectively necessary to perform the contract. Equally, an employer should not routinely rely on employee consent where the imbalance of power makes it difficult to establish that consent was genuinely freely given.

Processing special category and criminal offence data

Where special category data is involved, a lawful basis under Article 6 is not sufficient on its own. The controller must also identify an applicable Article 9 condition and, where required, satisfy additional provisions in the Data Protection Act 2018.

Criminal offence data is subject to the requirements of Article 10 and the relevant domestic statutory safeguards.

This creates a two-stage analysis for sensitive information: the controller must establish the general legal basis for processing and the additional legal condition authorising the processing of the particular category of data.

The ICO’s guidance on lawful bases and special category data provides further explanation. ICO+2

9. The rights of individuals under the UK GDPR

The UK GDPR gives individuals a series of rights designed to provide transparency and control over the use of their personal data. These rights are not absolute in every circumstance. Certain statutory exemptions and restrictions may apply, but organisations must be able to identify the legal basis for limiting a right.

The right to be informed

Articles 13 and 14 require controllers to provide individuals with information about the processing of their personal data.

Where information is collected directly from an individual, the controller must ordinarily explain matters such as its identity, purposes of processing, lawful basis, recipients, retention period and the individual’s rights.

Where information is obtained from another source, the controller generally has similar transparency obligations, subject to the statutory exceptions.

This information is commonly provided through a privacy notice. A privacy notice should be clear, accessible and sufficiently detailed to enable individuals to understand what happens to their information.

The right of access

Article 15 gives individuals the right to obtain confirmation of whether their personal data is being processed and, where it is, to receive a copy of that information together with specified supplementary information.

This is commonly called a subject access request (SAR).

The right concerns the individual’s personal data, not necessarily every document in which that data appears. A controller may provide extracts, copies of documents or another suitable format, provided the response gives access to the personal data and supplementary information required by law.

A request does not need to use the words subject access request or refer to Article 15. It may be made verbally or in writing, including through electronic communication.

The controller must verify the requester’s identity where reasonably necessary and may seek clarification where this is required to identify the information sought. Following the Data (Use and Access) Act 2025 reforms, controllers are required to make reasonable and proportionate searches for personal data in response to access requests. The statutory framework does not require unlimited searches of every conceivable system regardless of relevance or proportionality.

The ordinary response period is one month. This may be extended by up to a further two months where the request is complex or numerous requests have been made. The individual must be informed of the extension and the reasons for it within the initial period.

A controller may charge a reasonable fee or refuse a request where it is manifestly unfounded or excessive, but the statutory conditions must be satisfied. The controller cannot reject a request merely because responding requires work or because the information is held in several locations.

The right to rectification

Article 16 gives individuals the right to have inaccurate personal data corrected without undue delay. They may also request completion of incomplete personal data, including by providing a supplementary statement.

The right is particularly important where inaccurate records affect employment decisions, financial assessments, insurance, medical treatment or public services.

The controller must consider whether the information is objectively inaccurate or incomplete. A disagreement with an opinion does not necessarily establish that the personal data is inaccurate, although an opinion may need to be recorded as an opinion and attributed appropriately.

The right to erasure

Article 17 establishes the right to erasure, commonly called the right to be forgotten.

An individual may request deletion where, for example:

• The personal data is no longer necessary for the purpose for which it was collected.
• Consent is withdrawn and no other lawful basis applies.
• The individual successfully objects to processing and there are no overriding legitimate grounds.
• The data has been unlawfully processed.
• Erasure is necessary to comply with a legal obligation.

The right is subject to exceptions. An organisation may retain information where processing is necessary for freedom of expression, compliance with legal obligations, public-interest functions, certain public health purposes, archiving, research, statistics or the establishment, exercise or defence of legal claims.

A person therefore does not have an unconditional right to require every organisation to delete all information about them.

The right to restriction of processing

Article 18 allows individuals to require an organisation to restrict the use of personal data in specified circumstances.

This may apply while the accuracy of data is being verified, where processing is unlawful but the individual prefers restriction rather than erasure, or where the organisation no longer needs the data but the individual requires it for legal claims.

Restricted information may generally be stored but cannot be used freely for other purposes. Further processing is permitted only in the circumstances specified by the legislation, including certain situations involving consent, legal claims or important public interests.

The right to data portability

Article 20 allows individuals, in certain circumstances, to receive personal data they have provided to a controller in a structured, commonly used and machine-readable format.

Where technically feasible, the individual may also request that the data be transmitted directly to another controller.

The right generally applies where processing is based on consent or contract and carried out by automated means. It does not provide a general right to transfer every document or record held by an organisation.

The right to object

Article 21 gives individuals the right to object to certain types of processing, particularly processing based on public task or legitimate interests.

The controller must stop processing unless it can demonstrate compelling legitimate grounds that override the individual’s interests, rights and freedoms, or the processing is necessary for legal claims.

There is a stronger right to object to processing for direct marketing. Where an individual objects to direct marketing, the controller must stop processing their personal data for that purpose.

Rights concerning automated decision-making

Article 22 and the related provisions of the UK GDPR regulate decisions based solely on automated processing where those decisions produce legal effects or similarly significant effects on individuals.

The Data (Use and Access) Act 2025 amended the rules governing significant automated decision-making. The revised framework permits a wider range of automated decisions, subject to safeguards, transparency obligations and restrictions that are particularly important where special category data is involved.

Depending on the legal basis and circumstances, safeguards may include providing information about the decision, enabling the individual to make representations, allowing human intervention and providing an opportunity to contest the outcome.

The reforms do not create unrestricted permission to make consequential decisions through automated systems. Organisations must still comply with the applicable data protection principles, fairness requirements and statutory safeguards.

The ICO’s guidance on individual rights explains how these rights operate in practice. ICO+3

10. The Data Protection Act 2018: supplementary rules and special regimes

The Data Protection Act 2018 supplements the UK GDPR and provides a more detailed statutory framework for particular categories of processing. It is not merely an enforcement statute. It contains substantive rules concerning exemptions, sensitive information, criminal offence data, law enforcement processing, intelligence services and the functions of the Information Commissioner.

General processing and domestic safeguards

The Act supplements the UK GDPR by specifying conditions under which certain types of personal data may be processed. This is especially important for special category data and criminal offence data.

For example, Schedule 1 contains conditions for processing that may be relevant to employment, equality monitoring, safeguarding, legal claims, substantial public interest and other specified purposes.

Where a controller relies on certain Schedule 1 conditions, it may need to maintain an appropriate policy document explaining how it complies with the data protection principles and retains or deletes the relevant information.

The DPA also provides statutory exemptions and restrictions that may apply to particular rights and obligations. These are not general permissions to disregard data protection law. Each exemption must be interpreted according to its wording and purpose.

Law enforcement processing

Part 3 of the Data Protection Act 2018 establishes a separate regime for the processing of personal data by competent authorities for law enforcement purposes.

Competent authorities may include police forces, specified law enforcement bodies and other organisations carrying out functions within the statutory definition.

The regime covers processing for the prevention, investigation, detection or prosecution of criminal offences and the execution of criminal penalties, including the safeguarding against and prevention of threats to public security.

Part 3 has its own rules concerning lawfulness, data protection principles, individual rights, security, records, transfers and regulatory supervision. It should not be treated as identical to the general UK GDPR regime.

Intelligence services processing

Part 4 of the Data Protection Act 2018 provides a separate framework for personal data processing by the intelligence services. It recognises the particular operational and national security responsibilities of those organisations while imposing statutory requirements and safeguards.

The separate regimes demonstrate that data protection law is not a single uniform set of rules for every processing activity. The correct legal framework depends on who is processing the information and for what purpose.

11. The Data (Use and Access) Act 2025: reforms to the data protection framework

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. It amended the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.

The legislation did not replace the UK GDPR or the DPA 2018. Instead, it modified the existing framework, introducing new provisions intended to clarify certain legal requirements, facilitate specified forms of data use and modernise the regulatory system.

The implementation was phased. The ICO confirmed that all data protection provisions had entered into force by 19 June 2026. Consequently, an article describing the UK data protection framework as it stood before those commencement dates would now be incomplete.

Recognised legitimate interests

One significant change was the introduction of recognised legitimate interests as a distinct lawful basis for specified processing activities.

Under the ordinary legitimate-interests basis, a controller must establish that the processing is necessary for a legitimate interest and balance that interest against the individual’s rights and freedoms.

Recognised legitimate interests operate differently. For specified purposes, the legislation removes the requirement to conduct the ordinary balancing test, provided the statutory conditions are met.

This does not remove the need for lawfulness, fairness, transparency, purpose limitation, data minimisation and security. It also does not make every activity that an organisation considers beneficial a recognised legitimate interest. The statutory purposes and conditions must be satisfied.

Automated decision-making

The Act amended the framework governing significant decisions made solely through automated processing.

The revised rules provide greater scope for automated decision-making based on certain lawful bases, while retaining safeguards intended to protect individuals against unfair or harmful outcomes.

This reform is particularly relevant to recruitment, credit assessments, insurance, public administration, financial services and digital platforms. Organisations using automated systems must consider the applicable statutory restrictions, transparency obligations and the individual’s rights to challenge relevant decisions.

The use of artificial intelligence does not remove the obligation to comply with data protection law. A system that profiles individuals, predicts their behaviour or makes consequential decisions using personal data remains subject to the applicable legal framework.

Data subject access requests

The Act also clarified the framework governing subject access requests. Controllers must conduct reasonable and proportionate searches for the personal data covered by the request.

This recognises that organisations may hold information across complex electronic systems and databases. The requirement is to carry out an appropriate search, not to conduct an unlimited investigation into every possible source of information.

The reform does not remove the right of access or allow organisations to disregard relevant information simply because it is difficult to retrieve. The reasonableness and proportionality of the search must be assessed in context.

Data protection complaints procedures

A further important change is the statutory requirement for controllers to facilitate the making of data protection complaints.

The relevant provisions came into force on 19 June 2026. Organisations must provide an accessible means for individuals to complain about the way their personal data has been handled. They must acknowledge complaints within 30 days and investigate and respond without undue delay.

This requirement gives individuals a clearer internal route for raising concerns before or alongside approaching the ICO. It also requires organisations to establish procedures capable of identifying, recording and addressing data protection complaints.

A complaint may concern an organisation’s response to an access request, the accuracy of personal data, security arrangements, unlawful disclosure, excessive retention or another alleged infringement.

Regulatory powers and the ICO

The Data (Use and Access) Act 2025 modernised the ICO’s enforcement framework. The Commissioner has additional powers relating to investigations, including the ability to require individuals to attend interviews and to obtain technical reports in appropriate circumstances.

The Act also provides for changes to the institutional structure and governance of the regulator. The objective is to strengthen its capacity to supervise compliance with information rights legislation in an increasingly complex digital environment.

These changes are important for organisations because data protection compliance is not limited to responding to individual complaints. The ICO may investigate systemic failures, require corrective action and impose financial penalties where the statutory conditions are satisfied.

The official ICO overview of the Data (Use and Access) Act 2025 and the government’s commencement guidance provide the current implementation position. ICO+4

12. Controllers, processors and organisational responsibilities

The UK GDPR distinguishes between data controllers and data processors. The distinction determines who makes decisions about processing and who carries out processing on behalf of another organisation.

A data controller is the person or organisation that determines the purposes and means of processing personal data. A data processor processes personal data on behalf of a controller.

For example, a retailer that determines why customer information is collected and how it is used will generally be a controller. A cloud-hosting provider that stores and processes the information under the retailer’s instructions may act as a processor.

An organisation can be a controller for one activity and a processor for another. The legal status depends on the actual processing arrangements, not simply the contractual label.

Controller obligations

Controllers bear primary responsibility for ensuring that processing complies with the UK GDPR. They must identify lawful bases, provide privacy information, respect individual rights, implement appropriate security and demonstrate accountability.

They must also determine whether a data protection impact assessment is required before undertaking processing likely to result in a high risk to individuals’ rights and freedoms.

Where processing involves systematic monitoring, large-scale sensitive data or other high-risk activities, the organisation should assess the necessity and proportionality of the processing and identify measures to reduce potential harm.

Processor obligations

Processors must act on the controller’s documented instructions and comply with the contractual and statutory requirements governing processing.

A written data processing agreement should establish the subject matter, duration, nature and purpose of processing, categories of personal data, types of data subjects and respective responsibilities.

Processors must implement appropriate security measures, assist controllers with relevant compliance obligations, maintain required records and notify controllers of personal data breaches without undue delay.

A processor that determines the purposes and means of processing independently may be treated as a controller for that processing activity. The contractual designation alone does not determine its legal status.

Data protection officers

Certain organisations must appoint a Data Protection Officer (DPO). This includes public authorities and bodies whose core activities involve regular and systematic monitoring of individuals on a large scale or large-scale processing of special category or criminal offence data.

The DPO must have appropriate expertise and must be able to perform the role independently. The officer advises the organisation, monitors compliance, supports data protection impact assessments and acts as a contact point for individuals and the ICO.

Not every small business is legally required to appoint a DPO. However, every controller remains responsible for compliance, regardless of its size.

13. Data security and personal data breaches

Data protection law requires controllers and processors to implement appropriate technical and organisational measures to protect personal data.

The security measures should reflect the nature of the information, the risks associated with processing, the size and activities of the organisation and the available technology.

Examples include encryption, access restrictions, multi-factor authentication, secure backups, staff training, network monitoring, physical security and procedures for responding to incidents.

A personal data breach is a security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data.

Not every technical incident is necessarily a personal data breach. Equally, a breach does not require a hacker to have entered an organisation’s systems. Sending an email containing personal information to the wrong recipient, losing an unencrypted device or allowing unauthorised staff access may constitute a breach.

Notification to the ICO

Where a personal data breach is likely to result in a risk to individuals’ rights and freedoms, the controller must notify the ICO without undue delay and, where feasible, within 72 hours after becoming aware of it.

Where the notification is made after 72 hours, the controller must provide reasons for the delay.

If the breach is unlikely to result in a risk to individuals, notification to the ICO is not required. However, the controller must still document the breach, including its effects and the remedial measures taken.

Notification to affected individuals

Where a breach is likely to result in a high risk to individuals’ rights and freedoms, the controller must generally communicate the breach to the affected individuals without undue delay.

The communication should explain the nature of the breach, provide contact details for further information, describe the likely consequences and identify measures taken or proposed to address the problem.

There are statutory exceptions, including where appropriate technical and organisational protection measures made the data unintelligible to unauthorised persons or subsequent measures ensure that the high risk is no longer likely to materialise.

Consequences of inadequate security

A failure to implement appropriate security measures may result in regulatory investigation, enforcement action, financial penalties and compensation claims.

An organisation may also face contractual liability, reputational damage and operational disruption. The consequences can be particularly serious where a breach involves financial information, medical records, identity documents or sensitive personal data.

The ICO’s personal data breach guidance explains the notification requirements and the steps organisations should take.

14. International transfers of personal data

The UK GDPR regulates transfers of personal data from the United Kingdom to countries and territories outside the domestic data protection framework.

International transfers are common in modern commerce. They arise where an organisation uses overseas cloud services, shares information with foreign affiliates, outsources customer support or provides personal data to an international business partner.

A transfer may be permitted where the destination benefits from UK adequacy regulations. These recognise that the destination provides an adequate level of protection for personal data.

Where no adequacy decision applies, an organisation may rely on an appropriate safeguard, such as the relevant international data transfer agreement or an approved contractual mechanism, subject to the applicable legal requirements.

Certain derogations may also permit transfers in specific circumstances, although they should not be treated as a general substitute for appropriate safeguards.

The Data (Use and Access) Act 2025 amended the framework for assessing international transfers. The revised approach requires attention to the protection afforded to individuals and the relevant statutory test, rather than simply assuming that every transfer outside the United Kingdom is prohibited.

The organisation must also comply with the general principles of the UK GDPR. A transfer mechanism does not justify excessive collection, incompatible processing or inadequate security.

The ICO’s guidance on international transfers explains the applicable tests and safeguards. ICO+1

15. The relationship between freedom of information and data protection

FOIA and data protection legislation frequently apply to the same information. A public authority may receive a request for documents that contain both institutional information and personal data. It must then determine whether disclosure is permitted under FOIA without unlawfully interfering with the rights of identifiable individuals.

The central provision is section 40 of FOIA, which protects personal information.

Requests for the requester’s own personal data

Where an individual asks a public authority for information about themselves, the request will generally be handled under the UK GDPR and the Data Protection Act 2018 rather than FOIA.

This distinction matters because the two regimes have different purposes and disclosure rules. A subject access request gives an individual access to their own personal data. It does not give them an automatic right to every document in which their name appears.

For example, an individual seeking their employment records from a government department will ordinarily make a subject access request. A journalist seeking information about the department’s recruitment expenditure will generally use FOIA.

A request may contain both elements. In that situation, the authority should identify the relevant legal rights and process each part under the appropriate regime.

Requests for another person’s personal data

Where a FOIA request seeks personal information about another identifiable individual, section 40 may apply.

The authority must consider whether disclosure would constitute lawful processing under the UK GDPR and the Data Protection Act 2018. It must examine the relevant lawful basis, the individual’s reasonable expectations, the nature of the information and the circumstances in which it was obtained.

Information concerning a public official performing official duties may be treated differently from highly private information about an individual’s health, family circumstances or personal finances. However, public employment does not automatically remove data protection protection.

The question is not simply whether the information concerns a public figure or a public employee. It is whether disclosure would comply with the applicable data protection principles and statutory requirements.

Public interest and personal privacy

Transparency and privacy may point in different directions. Disclosure may promote accountability, expose maladministration or reveal the misuse of public funds. At the same time, disclosure may expose individuals to harassment, reputational harm or an unjustified invasion of private life.

The authority must apply the statutory framework rather than treating privacy as an automatic reason for refusal or public interest as an automatic justification for disclosure.

Section 40 is particularly important because it prevents FOIA from being used to circumvent the protections of data protection law. The two regimes are intended to operate together, not to undermine one another.

The ICO’s guidance on personal information and FOIA explains how authorities should approach requests involving identifiable individuals. ICO+1

16. The Information Commissioner’s Office: supervision and enforcement

The Information Commissioner’s Office is the independent regulator responsible for promoting and enforcing information rights in the United Kingdom. Its responsibilities extend to FOIA, the UK GDPR, the Data Protection Act 2018, the Environmental Information Regulations and the Privacy and Electronic Communications Regulations.

The ICO performs several functions:

• Investigating complaints from individuals and organisations.
• Assessing whether public authorities have complied with FOIA.
• Monitoring compliance with data protection legislation.
• Issuing guidance, codes of practice and regulatory recommendations.
• Conducting investigations and audits.
• Issuing information notices and other statutory notices.
• Requiring organisations to take corrective action.
• Imposing administrative fines where the statutory conditions are satisfied.

The Commissioner is not an ordinary court and does not determine every dispute in the same way as a judicial body. Its regulatory role is nevertheless essential because it provides independent supervision of information rights legislation.

Complaints about freedom of information requests

A person dissatisfied with a public authority’s handling of an FOIA request should ordinarily use the authority’s internal review procedure first.

An internal review is an opportunity for the authority to reconsider its original response, including the application of exemptions, the adequacy of searches, the public interest assessment and the time taken to respond.

The ICO recommends that requests for internal review should generally be made within 40 working days of the initial response. The authority should normally aim to complete the review within 20 working days, although a longer period may be justified in complex cases.

If the requester remains dissatisfied, they may complain to the ICO. The Commissioner can investigate whether the authority has complied with the legislation and, where appropriate, issue a decision notice.

A decision notice may require the authority to take specified steps, such as disclosing information or reconsidering a request in accordance with the law.

Complaints about data protection

An individual who believes that an organisation has mishandled their personal data may complain directly to the organisation.

Following the Data (Use and Access) Act 2025 reforms, controllers must facilitate the submission of data protection complaints and provide a process for acknowledging and investigating them.

An individual may complain about matters such as:

• An inadequate response to a subject access request.
• Unlawful collection or disclosure of personal data.
• Inaccurate information that has not been corrected.
• Excessive retention of personal information.
• Inadequate security measures.
• Unlawful profiling or automated decision-making.
• Failure to respect a valid objection or other individual right.

An individual may also complain to the ICO. The Commissioner may investigate the organisation’s conduct, consider whether the relevant legal requirements have been satisfied and take regulatory action where appropriate.

The ICO’s investigation does not automatically result in financial compensation for the complainant. Compensation claims are a separate legal matter, generally determined by the courts.

17. Enforcement notices, fines and compensation

The data protection framework provides several enforcement mechanisms intended to ensure compliance and address unlawful processing.

Information and enforcement notices

The ICO may issue information notices requiring an organisation to provide information necessary for the performance of its regulatory functions.

It may also issue enforcement notices requiring an organisation to take specified steps to comply with data protection legislation. Depending on the circumstances, this may involve correcting inaccurate data, changing processing practices, deleting unlawfully processed information or taking measures to protect individuals.

The Commissioner may also use other statutory powers, including assessment and audit powers, subject to the relevant legal conditions.

Administrative fines

The UK GDPR provides for substantial administrative fines. The maximum amount depends on the nature of the infringement and the applicable statutory category.

The higher maximum is generally £17.5 million or 4% of an undertaking’s total worldwide annual turnover for the preceding financial year, whichever is higher.

The lower maximum is generally £8.7 million or 2% of worldwide annual turnover, whichever is higher.

The applicable maximum is not an automatic penalty. The ICO must consider the circumstances of the infringement, including its nature, gravity and duration, the degree of responsibility, the categories of personal data affected, cooperation with the regulator and other relevant factors.

The Data (Use and Access) Act 2025 also modernised the Commissioner’s enforcement powers. The statutory framework should therefore be considered alongside the ICO’s current regulatory guidance.

Compensation under Article 82

Article 82 of the UK GDPR gives an individual who has suffered material or non-material damage as a result of an infringement a right to seek compensation from the controller or processor responsible, subject to the applicable statutory conditions.

Material damage may include financial loss, while non-material damage may include distress or other legally recognised harm.

The individual must establish the relevant infringement, damage and causal connection. A breach of data protection legislation does not automatically entitle every affected person to compensation in the absence of legally recoverable damage.

Section 168 of the Data Protection Act 2018 also recognises distress as a form of non-material damage for the purposes of compensation.

The right to compensation is distinct from the ICO’s regulatory powers. The Commissioner may investigate and take enforcement action, but a disputed claim for damages will ordinarily be determined through civil proceedings.

Court proceedings

A person may bring proceedings to enforce data protection rights under section 167 of the Data Protection Act 2018 and the relevant provisions of the UK GDPR.

The court may make an order requiring an organisation to comply with the individual’s rights. A separate claim for compensation may be brought where the statutory requirements are satisfied.

In England and Wales, such claims may fall within the jurisdiction of the County Court or High Court, depending on the nature and value of the proceedings and the applicable procedural rules.

The relationship between regulatory complaints and civil proceedings is important. A person does not necessarily have to obtain a favourable ICO decision before pursuing a compensation claim. Equally, a regulatory finding does not automatically determine the amount of compensation payable.

18. Appeals and judicial oversight

The decisions of the Information Commissioner are subject to statutory review and appeal mechanisms.

Under FOIA, a requester or public authority affected by a decision notice may appeal to the First-tier Tribunal (General Regulatory Chamber). The Tribunal examines the appeal in accordance with the statutory framework and may consider the legal and factual issues within its jurisdiction.

Further appeals may be available to the Upper Tribunal on points of law, subject to permission requirements. Appeals from the Upper Tribunal may proceed to the Court of Appeal and, in appropriate cases, the Supreme Court.

Data protection regulatory decisions may also be appealed to the First-tier Tribunal. The Tribunal can examine whether the Commissioner applied the law correctly and whether the decision should be upheld, varied or set aside within the scope of its jurisdiction.

Judicial review may be available in appropriate cases where a public authority or regulator has acted unlawfully, irrationally or procedurally unfairly. It is not ordinarily a substitute for an available statutory appeal.

The courts also play a wider role in interpreting information rights legislation, particularly where freedom of information, privacy, confidentiality, freedom of expression and public accountability intersect.

The judicial framework ensures that the Information Commissioner exercises regulatory powers within the limits established by Parliament and that individuals and organisations have access to independent review.

19. Practical compliance: what organisations must do

Compliance with information rights legislation requires a structured approach. Organisations should not treat freedom of information and data protection as isolated administrative functions. Both involve the management of recorded information, the protection of individual rights and the accountability of decision-makers.

Establishing information governance

Public authorities should maintain clear procedures for receiving, identifying, recording and responding to FOIA requests. Employees should understand that a request may be valid even if it is sent to an ordinary departmental email address rather than the designated information officer.

Authorities should maintain adequate records-management systems so that relevant information can be located and retrieved within statutory periods.

Private organisations should also establish data governance arrangements appropriate to their activities, even where FOIA does not apply to them.

Maintaining privacy information

Controllers should provide clear privacy notices explaining what information they collect, why they collect it, how it is used, who receives it and how long it is retained.

Privacy information should be reviewed whenever the organisation introduces a new processing purpose, changes its systems or begins sharing information with additional recipients.

Conducting data protection impact assessments

A data protection impact assessment (DPIA) is required where a type of processing is likely to result in a high risk to individuals’ rights and freedoms.

A DPIA should describe the processing, assess its necessity and proportionality, identify risks and explain the measures adopted to address them.

It is particularly relevant to large-scale monitoring, sensitive information, biometric systems, extensive profiling and certain automated decision-making arrangements.

Managing third-party processing

Organisations that outsource data processing must identify the legal status of their service providers and establish appropriate contractual safeguards.

A data processing agreement should regulate instructions, confidentiality, security, assistance with individual rights, breach notification, subcontracting and the return or deletion of personal data when the relationship ends.

Where information is transferred internationally, the organisation must also establish an appropriate transfer mechanism.

Training and internal accountability

Staff should understand the difference between a freedom of information request, a subject access request, a data protection complaint and an ordinary customer-service enquiry.

They should also know how to identify potential data breaches, report incidents and refer requests to the appropriate internal team.

An organisation that fails to establish adequate internal procedures may find that even a relatively straightforward request becomes a compliance problem.

Key Takeaways

• FOIA 2000 establishes a general right of access to recorded information held by public authorities. It is not limited to citizens or residents.
• The ordinary FOIA response period is 20 working days, and a public authority must disclose non-exempt information or provide a legally sufficient explanation for refusal.
• FOIA contains absolute and qualified exemptions. Qualified exemptions require a public interest assessment.
• Environmental information is generally governed by the Environmental Information Regulations 2004 rather than FOIA.
• The UK GDPR and Data Protection Act 2018 regulate the processing of personal data throughout the United Kingdom.
• The UK GDPR establishes six fundamental data protection principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality.
• A controller must identify an appropriate lawful basis under Article 6 before processing personal data. Special category data and criminal offence data require additional legal conditions.
• Individuals have rights of access, rectification, erasure, restriction, portability and objection, as well as protections relating to certain automated decisions.
• The Data (Use and Access) Act 2025 amended the existing framework. Its data protection reforms are in force as at 31 October 2026.
• The Act introduced recognised legitimate interests, amended automated decision-making rules, clarified subject access procedures and strengthened the regulatory framework.
• Controllers must facilitate data protection complaints, acknowledge them within 30 days and investigate and respond without undue delay.
• The ICO supervises compliance and may issue notices, investigate infringements and impose administrative fines.
• Individuals may seek compensation for material or non-material damage caused by infringements, subject to the applicable legal requirements.

Frequently Asked Questions

1. Can anyone make a Freedom of Information request in England and Wales?

Yes. FOIA is not limited to British citizens, residents, journalists or people directly affected by a public authority’s decision. Any person may request recorded information held by a public authority, provided the request satisfies the statutory requirements.

2. Does a Freedom of Information request have to be made in writing?

Generally, yes. Section 8 requires a request to be in writing, to state the requester’s name and an address for correspondence, and to describe the information sought. Electronic requests, including emails, are valid. Environmental information requests under the EIR may be made orally.

3. How long does a public authority have to respond to an FOIA request?

The ordinary statutory period is 20 working days from receipt of the request. The authority must respond promptly and cannot normally use the entire period merely to acknowledge receipt. Limited statutory extensions and variations may apply.

4. Can a public authority refuse to disclose information because it is embarrassing?

No. Embarrassment, political inconvenience or the possibility of criticism is not, by itself, a lawful exemption. The authority must identify an applicable statutory exemption and comply with its conditions, including the public interest test where required.

5. What is the difference between FOIA and a subject access request?

FOIA allows members of the public to request recorded information held by public authorities. A subject access request allows an individual to obtain their own personal data from a controller. The two rights have different purposes, procedures and disclosure rules.

6. Does an organisation always need consent to process personal data?

No. Consent is only one of the lawful bases under Article 6 of the UK GDPR. Processing may also be justified by contract, legal obligation, vital interests, public task, legitimate interests or recognised legitimate interests. The organisation must select the basis that genuinely applies to its processing.

7. Can an individual demand that all personal information about them be deleted?

No. The right to erasure is subject to statutory conditions and exceptions. Organisations may retain personal data where processing remains necessary for legal obligations, public-interest functions, legal claims or other permitted purposes.

8. What happens if an organisation refuses a subject access request?

The organisation must explain the legal basis for its refusal where required. The individual may raise a complaint with the organisation and subsequently approach the ICO. They may also pursue judicial remedies where the statutory requirements are satisfied.

9. What is the difference between a data controller and a data processor?

A controller determines the purposes and means of processing personal data. A processor handles personal data on behalf of a controller and generally acts under its documented instructions. An organisation may perform both roles for different processing activities.

10. What is the role of the Information Commissioner’s Office?

The ICO is the independent regulator responsible for overseeing information rights legislation. It investigates complaints, issues guidance, monitors compliance and has statutory powers to require corrective action and impose penalties.

11. Can an individual receive compensation for a data protection breach?

Yes, where the legal requirements are satisfied. Article 82 of the UK GDPR and section 168 of the Data Protection Act 2018 provide for compensation for material and non-material damage resulting from an infringement. A breach alone does not automatically establish an entitlement to damages.

12. Does the Data (Use and Access) Act 2025 replace the UK GDPR?

No. It amends the existing framework rather than replacing it. The UK GDPR and Data Protection Act 2018 remain the central legislation governing personal data processing, as modified by the 2025 Act.

13. Does data protection legislation apply to information about companies?

Personal data protection primarily concerns identifiable living individuals. Information relating solely to a corporate legal entity is not ordinarily personal data. However, information about directors, employees, customers, sole traders and other identifiable individuals may be protected.

14. Are public authorities exempt from data protection law?

No. Public authorities must comply with the UK GDPR and Data Protection Act 2018 when processing personal data. They may rely on particular lawful bases and statutory exemptions where appropriate, but their public status does not create a general exemption.

Conclusion

Freedom of information and data protection form two complementary pillars of modern information law. FOIA 2000 promotes transparency by enabling the public to scrutinise information held by public authorities. The UK GDPR and Data Protection Act 2018 protect individuals by regulating how personal information is processed and establishing enforceable rights.

The relationship between the regimes requires careful legal analysis. Public access to information cannot be treated as an unrestricted entitlement to private personal data, just as data protection cannot be used as a general justification for withholding information that should lawfully be disclosed. The statutory framework requires public authorities and other controllers to identify the correct legal regime, apply the relevant exemptions or lawful bases and justify their decisions.

The Data (Use and Access) Act 2025 represents an important development in this framework. Its reforms have altered the rules governing recognised legitimate interests, automated decision-making, subject access requests, complaints procedures and regulatory supervision. The resulting system seeks to accommodate technological and economic developments while preserving the central principles of transparency, fairness, accountability and individual protection.

Ultimately, information rights law is concerned with the relationship between power and information. Public authorities must be answerable for the information they hold and the decisions they make, while organisations must respect the rights of individuals whose personal data they control. Effective enforcement through the Information Commissioner’s Office, tribunals and courts ensures that these principles have practical legal consequences.

Principal legislation and official sources

Freedom of information and environmental information

• Freedom of Information Act 2000
• Environmental Information Regulations 2004
• ICO – Guide to Freedom of Information
• ICO – FOIA exemptions
• ICO – Timescales for FOIA requests

Data protection

• UK General Data Protection Regulation
• Data Protection Act 2018
• Data (Use and Access) Act 2025
• Privacy and Electronic Communications Regulations 2003
• ICO – Guide to Data Protection
• ICO – Individual rights
• ICO – Data (Use and Access) Act 2025
• GOV.UK – Data (Use and Access) Act 2025: commencement

Editorial note: This article reflects the legal framework as at 31 October 2026. The Data (Use and Access) Act 2025 has been brought into force in stages, and the data protection reforms are now in force. Future updates should pay particular attention to revised ICO guidance, the implementation of the recognised legitimate interests framework and the developing interpretation of automated decision-making safeguards.