For Individuals Only

This website is designed for individual consumers to understand their rights and track their own SAR and FOI requests.

It is not intended for commercial use by organisations, companies, or professionals managing requests on behalf of others.

Back to ICO Complaint Guide

Internal Review Process

What to expect and when to request one

Under FOIA, there is no statutory obligation for an authority to provide a complaints process. However, it is good practice under the Section 45 Code of Practice, and most public authorities choose to do so. Under EIR, there is a legal requirement that internal reviews must be carried out as soon as possible and within 40 working days.

When Should You Request an Internal Review?

After a Refusal

If the authority refuses your request, their refusal notice should state whether they have an internal review procedure and how to access it.

After a Delay

If you're still waiting for a response and are unhappy with the delay, you should request an internal review.

Disagree with Interpretation

If you disagree with how they interpreted your request, or believe they hold more information than they've disclosed.

Disagree with Public Interest Test

If you believe the public interest favours disclosure more than the authority's decision suggests.

Don't wait too long: A public authority could refuse to deal with your internal review request if you wait longer than 40 working days from their response.

Step-by-Step Process

1

Request an Internal Review

Contact the public authority in writing and ask them to review their decision. Politely explain why you disagree, being as clear and specific as possible.

What to include:

  • Your original request reference number
  • Date of their response
  • Specific reasons you're dissatisfied
  • Why you believe the decision was wrong

Timeline: Authorities should respond within 20 working days (40 in exceptional circumstances). Under EIR, there's a legal requirement to respond as soon as possible and within 40 working days.

Tip: It might help to get a second opinion from someone you know, to assess whether the response is fair and makes sense.
2

What Happens During the Review

The authority should:

  • Make a fresh decision based on all available evidence relevant to the date of your original request
  • Ensure the review is done by someone who did not deal with the original request (preferably a more senior member of staff)
  • Carry out the review in an independent and fair way
  • Consider whether circumstances have changed and if further information could now be released

ICO guidance: Even if the review upholds the original decision, authorities may wish to release further information if circumstances have changed and original concerns about disclosure no longer apply. This isn't required but may resolve matters and reduce the likelihood of an ICO complaint.

3

Receive the Outcome

The authority will provide their internal review decision. This will either:

  • Uphold their original decision
  • Partially uphold with some additional information released
  • Reverse their decision and release the information

If you're still dissatisfied, you can then complain to the ICO.

4

Complain to the ICO

If you're unhappy with the outcome of the internal review, you can complain to the ICO within six weeks of their response or your last substantive contact.

The ICO will need copies of:

  • Your original request
  • The authority's response
  • Your internal review request
  • The internal review outcome
Read our full ICO complaint guide →

Internal Review Template Letter

[Date]

Ref No: [if applicable]

Thank you for your response to my information request, sent on [date], copy attached.

I am dissatisfied with the handling of my request for the following reason(s):

[Explain why you are unhappy with the result of your request. For example:

- I disagree with the outcome of the public interest test because...
- I don't believe the cost of providing the information would exceed the cost limit because...
- You have not provided me with enough support to refine my request...
- I disagree that the exemption applies because...
- I believe you hold more information than you have disclosed...
- I disagree with your interpretation of my request...]

Please carry out an internal review of the handling of my request and consider changing your position.

I understand that you should respond to me within 20 working days, as outlined in the Information Commissioner's guidance:

"The Information Commissioner's Office recommends that public authorities carry out internal reviews within 20 working days. Under Environmental Information Regulations there is a legal requirement that internal reviews must be carried out as soon as possible and within 40 working days."

Thanks,

[Your name]

What Authorities Should Do (ICO Guidance)

For public authorities conducting internal reviews:

Source: ICO Section 45 Code of Practice

Further reading:

Need further advice?

For further advice, you can contact the ICO via their live chat service or call their helpline:

Helpline: 0303 123 1113

Live chat: ico.org.uk/live-chat

Monday to Friday, 9am to 5pm

Back to ICO Complaint Guide