Frequently Asked Questions

SAR (Subject Access Request): You can request your own personal data from any organisation that holds it. This right comes from UK GDPR Article 15.

FOI (Freedom of Information): You can request any recorded information from public authorities (councils, NHS, government departments, etc.). This right comes from the Freedom of Information Act 2000.

The key difference: SAR is about YOUR personal data. FOI is about ANY information held by a public authority.

SAR: 1 calendar month from receipt. This can be extended by up to 2 months for complex or numerous requests.

FOI: 20 working days from receipt. This can be extended for public interest test considerations (usually up to an extra 20 working days).

SAR: Generally no. SARs are free unless the request is manifestly unfounded or excessive, in which case they can charge a reasonable fee or refuse.

FOI: They cannot charge for staff time or search costs. They can charge for postage, photocopying, or other disbursements.

No. For a SAR, simply asking for "my personal data" or "my information" is enough. For FOI, asking for information in writing with your name and address is valid. You don't need to quote "GDPR", "Article 15", or "FOIA".

Only if the organisation genuinely needs to verify your identity. Don't send ID unless asked. If they ask, they must have a valid reason and you should provide it promptly as the clock stops while they wait.

Yes. You can request emails, messages (Teams, Slack, WhatsApp), call recordings, CCTV footage, and any other recorded information that contains your personal data. Be specific about what you want to help them locate it.

They must prove it. A request isn't excessive just because it's large. They must demonstrate it's disproportionate. If they claim this, ask for their reasoning and evidence. You can challenge this with the ICO if you disagree.

Only if a valid exemption applies (e.g., legal professional privilege, confidential references, or if disclosing would prejudice management planning). They cannot refuse just because you're in a dispute or tribunal. If they refuse, they must explain which exemption and why.

Any information that relates to an identified or identifiable living individual. This includes names, addresses, email addresses, phone numbers, IP addresses, CCTV footage, call recordings, HR records, emails about you, and more. It also includes opinions about you and indications of intentions towards you.

Anyone in the world. You don't need to be a UK citizen or resident. FOI rights apply to everyone.

Under Section 12, they can refuse if the cost exceeds £600 for central government or £450 for other authorities. If refused, they must provide advice and assistance to help you refine your request to bring it within the limit.

A qualified exemption (like Section 36 - prejudice to effective conduct of public affairs) requires a public interest test. They must weigh the public interest in disclosure against the public interest in maintaining the exemption. They must explain their reasoning in the refusal notice.

An absolute exemption (like Section 40 - personal data, or Section 41 - information provided in confidence) means no public interest test is needed. If the exemption applies, they can refuse without weighing public interest.

Under Section 14, yes, but "vexatious" has a high legal threshold. It must cause unjustified distress or be obsessive. Legitimate scrutiny, even if critical, does not automatically make a request vexatious. They must still issue a refusal notice explaining this.

Under Section 17 FOIA, it must include:

• The exemption they're relying on
• Why the exemption applies
• Public interest test reasoning (for qualified exemptions)
• Internal review procedure details
• Your right to complain to the ICO

For SARs, they must explain the reasons, which exemption, and your rights to complain.

Write to the organisation stating you want an internal review of their decision. Explain why you believe the refusal was wrong (e.g., the exemption doesn't apply, public interest favours disclosure). For FOI, this should usually be completed within 20-40 working days.

FOI/EIR: Within 6 weeks of your last contact with the organisation.

SAR: The ICO expects complaints within 3 months of the organisation's final response.

The ICO can:

• Investigate your complaint
• Issue decision notices
• Require the organisation to comply
• Issue enforcement notices
• Impose fines for serious breaches

You can appeal to the First-tier Tribunal (Information Rights) if you disagree with an ICO decision notice. You usually have 28 days to appeal. Under Section 166 DPA 2018, if the ICO fails to progress your complaint within 3 months, you can apply to the Tribunal for an order requiring them to respond.

Yes. Keep email receipts, proof of postage, or screenshots. You'll need this if they claim they never received your request.

Respond quickly. For SARs, the clock stops while they wait for ID or clarification. Any delay pushes your deadline back. For FOI, the clock may pause while they seek clarification.

Yes. Under Section 11 FOIA, you can request information in a particular format (e.g., electronic copy, paper copy, inspection). They must comply where reasonably practicable. Under the Equality Act, you can request accessible formats (Braille, large print, audio).