Key information-rights definitions
A focused glossary for the terms used across the WWTR guides. Broader consumer-law terminology has deliberately been left out.
Data protection
Personal data / personal information
Information relating to an identified or identifiable living person. Whether information is personal data depends on context, identifiability and the relationship between the information and the person.
Controller
The person or organisation that determines the purposes and means of processing personal data.
Processor
A person or organisation that processes personal data on behalf of a controller.
SAR / DSAR
A subject access request (sometimes called a data subject access request): a request exercising the right of access to personal information and related supplementary information.
Reasonable and proportionate search
The current statutory search standard for responding to a SAR: controllers need not undertake searches that are unreasonable or disproportionate, but must be able to justify the search actually carried out.
Manifestly unfounded or excessive
A high-threshold provision that can allow an organisation to refuse a rights request wholly or partly, or in some circumstances charge a reasonable fee. The decision must be justified on the facts.
Data-protection complaint
A complaint that an organisation has infringed data-protection law in the way it handled personal information or a data-protection rights request. Controllers have statutory complaint-handling duties from 19 June 2026.
FOI & EIR
FOIA
The Freedom of Information Act 2000, which provides access to recorded information held by public authorities, subject to exemptions and other provisions.
FOISA
The Freedom of Information (Scotland) Act 2002, which generally governs access to recorded information held by Scottish public authorities. Its review and appeal route is separate from FOIA 2000.
EIR
The Environmental Information Regulations 2004, a separate access regime for environmental information held by public authorities.
Scottish EIRs
The Environmental Information (Scotland) Regulations 2004, the environmental-information regime for Scottish public authorities. They have their own review and appeal route to the Scottish Information Commissioner.
Public authority
A body within the scope of FOIA and/or EIR. The exact statutory coverage matters; not every organisation performing a public-facing function is automatically within FOIA.
Exemption / exception
FOIA generally refers to exemptions; EIR uses exceptions. Some are subject to a public-interest test and some have additional threshold tests.
Internal review / reconsideration
The authority's review of its handling and decision. Under FOIA it is the established complaint route under the Code and ICO guidance; under EIR regulation 11 provides a statutory reconsideration process.
Public-interest test
A balancing exercise used where the legislation requires the authority to weigh the public interest in maintaining an exemption/exception against the public interest in disclosure.
Regulator
ICO
The Information Commissioner’s Office, the regulator responsible for UK data protection and for FOIA 2000 and EIR 2004. It is not the external appeal body for FOISA or the Scottish EIRs.
Scottish Information Commissioner
The independent commissioner who enforces FOISA and the Environmental Information (Scotland) Regulations 2004. This is a different office from the UK Information Commissioner / ICO.
Official sources
- ICO – Subject access guidance
- ICO – Individual rights
- ICO – FOI guidance
- ICO – EIR guidance
- Scottish Information Commissioner – FOI and EIR guidance
Reviewed September 2026. This page is general information, not legal advice. For a live dispute or critical deadline, check the current ICO guidance and legislation.