Information Rights Route Checker
Information Rights Route Checker
Select what type of information you want and the checker will show the relevant legal route and main timing/cost rules.
FOI vs Subject Access vs Environmental Information
| Feature | FOI | Subject Access Request | EIR |
|---|---|---|---|
| Main purpose | Access recorded information held by a public authority. | Access your own personal data. | Access environmental information. |
| Main law | Freedom of Information Act 2000 | UK GDPR Article 15 and applicable DPA 2018 provisions | Environmental Information Regulations 2004 |
| Normal response period | 20 working days | One month, subject to the current UK GDPR time-limit rules and possible extension | Normally one month, subject to EIR rules |
| Who can use it? | Any person can generally make an FOI request, subject to the statutory requirements. | A data subject, or someone lawfully acting for them. | Anyone seeking environmental information from a relevant public authority. |
| Cost rule | Usually free, but section 12 cost limits and permitted charges can apply. | Normally free, subject to limited fee provisions. | Separate EIR charging rules apply. |
| Main restriction examples | Cost, vexatious/repeated requests and FOIA exemptions. | Applicable data-protection exemptions and restrictions. | EIR exceptions and manifest-unreasonableness rules. |
How to Make an FOI Request
An FOI request should describe the recorded information you want clearly enough for the authority to identify it. You should normally provide your name and an address for correspondence, such as an email address.
You can request information in a particular format where appropriate. An authority does not generally have to create new information or carry out new analysis merely because a requester asks a question.
If the authority refuses the request, its response should explain the reason for refusal and the applicable exemption or other basis. You can normally ask for an internal review before complaining to the ICO.
How to Make a Subject Access Request
A SAR is for your personal data. You can make one verbally or in writing, although writing is usually better because it creates a clear record of what you requested.
An organisation may reasonably need information to confirm your identity. Under the current 2026 rules, the applicable time period is linked to receipt of the request and, where relevant, identity information or a permitted fee.
The normal period is one month. A controller can extend by up to two further months where the legal conditions concerning complexity or the number of requests are met and the required notice is given.
Important FOI Exemptions and Cost Rules
| Rule | What it means | Public-interest test? |
|---|---|---|
| Section 12 | The estimated cost of determining whether information is held, locating/retrieving it and extracting it exceeds the appropriate limit. | Not a Part II exemption/public-interest balancing test. |
| Section 21 | Information is reasonably accessible to the requester by another route. | No. It is an absolute exemption. |
| Section 40 | Personal information can be exempt where disclosure would breach the applicable data-protection rules. | Section 40(2) is absolute where its conditions are met. |
| Section 14 | Vexatious or repeated requests can be refused where the statutory conditions are satisfied. | Depends on the provision being relied upon. |
| Qualified exemptions | Where a qualified exemption is engaged, the authority must also conduct the required public-interest balancing test. | Yes. |
What Happens After a Refusal or Delay?
Follow up / internal review
If the authority is late or you disagree with its response, normally raise the matter with the authority first and request an internal review where available.
Independent complaint
After the authority's review, you can generally complain to the ICO. The ICO can investigate the handling of the request and may issue a Decision Notice.
Further appeal
Where the applicable appeal rights exist, an ICO decision can be appealed to the First-tier Tribunal (Information Rights).
2026 Data Protection Changes You Should Know
The Data (Use and Access) Act 2025 introduced changes to UK data protection law. The ICO confirmed in June 2026 that the relevant data-protection provisions are now in force.
For Subject Access Requests, the updated rules clarify the applicable time period, allow the controller to pause the clock in specified circumstances when clarification is requested, and allow an extension of up to two further months where necessary because of the complexity or number of requests.
The updated framework also makes clear that organisations only need to carry out reasonable and proportionate searches for relevant personal information. These changes mean that older descriptions of SAR procedure should not automatically be used as a 2026 guide.
Frequently Asked Questions (6)
- • GOV.UK — Make a Freedom of Information request: GOV.UK FOI guidance
- • ICO — FOI guidance and complaints: ICO information rights guidance
- • ICO — Subject Access Requests: ICO SAR guidance
- • ICO — Data (Use and Access) Act 2025: 2026 DUAA guidance
- • Legislation — Data (Use and Access) Act 2025: Current legislation