FOI & EIR internal review

First identify the legal regime

The review route is not identical across the UK. FOIA 2000 and EIR 2004 complaints generally proceed to the ICO. FOISA 2002 and the Scottish EIRs proceed to the Scottish Information Commissioner.

FOIA 2000: internal review

FOIA does not itself create a statutory right to an internal review in the same way as EIR, but the section 45 Code and ICO practice expect authorities to operate a complaints procedure. The ICO normally expects an internal review to be completed within 20 working days, with up to 40 working days only in exceptional circumstances.

Ask for a review promptly. The ICO generally recommends doing so within 40 working days of the authority's response.

EIR 2004: statutory reconsideration

Under regulation 11, a requester can make representations to the authority if they believe it failed to comply with the EIR. The authority must reconsider the matter and notify the requester of the outcome as soon as possible and no later than 40 working days after receiving the representations.

Scotland: FOISA and Scottish EIR reviews

For Scottish public authorities, a request for review normally has to be made within 40 working days of receiving the authority's response. If the authority did not respond to the original request, the Scottish framework allows a review request within the applicable period described by the Commissioner, effectively up to 60 working days after the original request in the ordinary case.

The Scottish public authority then has a maximum of 20 working days to carry out the review. If you remain dissatisfied, or the review response is late, an application can be made to the Scottish Information Commissioner. The normal application limit is six months from the review outcome or the date by which it should have been issued.

What to challenge

• The authority says it does not hold information you believe should exist.
• An exemption or EIR exception appears to have been applied too broadly.
• The public-interest reasoning is generic or missing.
• The search appears inadequate.
• The authority failed to provide advice and assistance.
• The response or refusal notice was late or procedurally defective.

Template

After the review

For FOIA/EIR 2004, the next external complaint is normally to the ICO. For FOISA/Scottish EIRs, the next route is the Scottish Information Commissioner. Keep the original request, response, review request and review outcome together.

Official sources

• ICO – if you are dissatisfied with an FOI/EIR response
• ICO – EIR internal reviews
• FOISA – requirement for review
• Scottish Information Commissioner – appeal

Reviewed September 2026. Guidance checked against current ICO / Scottish Information Commissioner material and legislation. General information only; verify critical deadlines against the applicable law.