Each year, on 28 September, we observe the International Day for Universal Access to Information. 

It’s an opportunity to champion transparency, accountability, and the public’s right to know – as well as reflecting on the ICO’s role in making that happen. 

This year, we also celebrated the 20th anniversary of FOIA coming into effect, looking at our own approach to FOI and how this has evolved.  

In 2022 we made a fundamental change, choosing to focus on targeted guidance and support to proactively help prevent breaches of the FOI and Environmental Information Regulations (EIR) legislation. We recently evaluated and published a report on the impact of this new ‘upstream’ approach, and we’re pleased to see that our intervention is making a difference. 

Most importantly, we’ve found that results are achieved when we use a combination of the regulatory tools available to us. This encompasses everything from providing simple templates to help FOI practitioners get the basics in place, alongside bitesize guidance to tackle the most common problem areas, to issuing enforcement notices when public authorities have not shown the improvement we expect to see.  

Action we’ve taken 

We want to empower public authorities to meet their responsibilities under FOI and EIR by collaborating with them to foster improvement and drive meaningful change, before more formal regulatory intervention becomes necessary.  

A great example of this is our work with UK water companies amid growing public concern over the lack of transparency around sewage discharges. Because of our intervention, they are now proactively disclosing more information. 

Where our intervention doesn’t achieve the change we want to see, we will not hesitate to act. Over the past three years, we have taken more enforcement action than we have in the entire lifetime of the FOI Act - having issued 24 enforcement notices and 36 practice recommendations since the introduction of the FOI and Transparency regulatory manual in 2022.  

Most recently, we issued an enforcement notice to Liverpool City Council. Between 1 January and 31 July 2025, we found that the Council had responded to just 56% of information requests within the required 20 working days and had a backlog of 75 overdue requests. The notice requires them to publish a clear, time-bound action plan for resolving these issues.  

We’ve also issued a practice recommendation to Belfast Health and Social Care Trust who had a 53% FOI compliance rate during April to July 2025. While they have taken steps to improve performance, the practice recommendation will help them improve their practices in future. 

We have also undertaken focused work to help specific sectors improve. For example, we conducted a deep dive into FOI practice at NHS Trusts in England, which resulted in regulatory action being taken.  

Additionally, we have carried out audits involving ten police forces, which made 152 recommendations for improvements.  

And, we have issued enforcement notices to nine police forces to ensure a backlog of 3,630 outstanding requests were responded to.  

Our attention now turns to local authorities, and we’ll keep you updated on the outcome.  

So, what else have we achieved?  

While enforcement action remains an important power that we can exercise when needed, it is not the only way to encourage public authorities to do better. 

Our range of bitesize guidance helps public authorities get to grips with areas of FOI that commonly cause issues, such as the correct application of certain exemptions. We continue to develop new resources to address specific scenarios that practitioners told us matter to them, the latest of which is a guide to complying with information request obligations at a time of organisational change which should be particularly helpful for local government given the current reorganisation in England.  

We also have new advice on the use of disclosure platforms to help authorities manage requests appropriately while taking advantage of software and technology. 

But our focus hasn’t been limited to large organisations - FOI obligations extend across a range of public bodies. That’s why we’ve developed tailored guidance for GPs and practice staff as well as schools, and we’re actively exploring where our support can have the greatest impact next.  

And, we recognise that people who request information are our customers too. Which is why we have published resources for using information rights effectively.   

What next? 

We will continue to push public authorities to proactively publish information and advocate for transparency being a priority.  

We’ll continue updating our most popular resources, which include the learning points from decision notices and Information Tribunal decisions, alongside regular case studies showcasing good practice and how organisations have managed to improve their performance.   

And, of course, we’ve got FOI-specific sessions at the ICO’s flagship event, the Data Protection Practitioners Conference (DPPC), so if you haven’t booked your place, make sure you do! 

Thanks!  

I’d like to thank our Upstream Feedback Group for their invaluable contributions in helping us refine and enhance our resources. What began as an innovative test to see if we could make a difference to the way that organisations approach FOI, and the experience people have when trying to obtain public information, has become a cornerstone of the ICO’s approach to regulating the FOIA. 

As always, we’re keen to hear from practitioners about what they want to see next from the ICO and welcome any feedback you may have.