Advice for schools on the FOIA and responding to requests for information
What are our responsibilities to respond to requests for information?
Did you know that:
- state schools must respond to requests for information from the public;
- any member of staff might receive a request; and
- you must proactively make some information available?
The laws governing this are the Freedom of Information Act 2000 (FOIA) and Environmental Information Regulations 2004 (EIR). These laws are devolved in Scotland, but Scottish schools have similar responsibilities.
Requests can be sent by anyone: researchers, journalists, commercial organisations, members of the public, or people connected with the school. You must treat them all in the same way.
It’s everybody’s responsibility to know what to do when you receive a request for information. We know that dealing with requests can be daunting, but we want to support schools in getting it right.
Who’s responsible for compliance at our school?
At most non-academy schools, the board of governors is responsible for compliance with FOIA and the EIR (the Education Authority oversees this for controlled schools in Northern Ireland).
At school trusts, it’s the academy trust board as "proprietor” that’s responsible for compliance with FOIA and EIR, regardless of how many schools are in the trust.
A request is valid whether it’s addressed to the governors, trustees, the school, or to a staff member.
We recommend designating a member of staff as an FOI and EIR officer to handle and track requests. You should:
- tell all your staff who the officer is;
- tell staff to send all requests for information to the officer straight away, because there are strict timeframes for responding; and
- remind staff to keep an eye on ‘spam’ or ‘other’ email folders in case a request has ended up there; the clock starts ticking to respond as soon as requests arrive, even if you haven’t opened the message.
When should we respond to requests?
You must respond promptly, within 20 school days (this means days when students are in school). In any case the maximum time limit for response must not exceed 60 working days (this means any day that is not a Saturday, Sunday, or a public or bank holiday).
If a multi-academy trust has different term dates across the trust, you must take account of school days for the academy the request relates to.
Should we respond under FOIA or the EIR?
Whilst FOIA covers information such as accounts and exam results, it doesn’t cover environmental information. This is information about things that affect, or relate to, the environment. For example, information about your school buildings, your outdoor spaces, or traffic management. To help you understand the difference, see our guide to whether information is ‘environmental’.
There are some differences in how the two laws work. Our website has detailed guidance on FOIA and the EIR.
What information should we publish proactively?
You must make some information available proactively. Please see our guide to publication schemes.
You could also proactively publish commonly-requested information. Public authorities have told us that this can help to manage the volume of requests.
Do we have to provide the requested information?
Although you must respond to requests, there are exemptions to protect information that you should not disclose. This may be, for example, because disclosing it would cause harm or would be against the public interest. So, you can sometimes refuse a request. You should also consider whether the requester has a right of access under other legislation, such as the UK General Data Protection Regulation (UK GDPR).
How should we respond to requests?
The following are examples of the type of requests you may receive and how to respond.
A parent asks for their child’s school record.
You must handle this in line with the UK GDPR or the relevant education regulations; see our guidance on accessing pupil information.
Someone wants the content of lesson plans.
You must handle this under FOIA. You should consider whether the plans are another organisation’s commercial property, or if there’s any personal information on the plans.
Someone requests a TA’s timetable.
You must handle this under FOIA. It might be exempt, if it’s the person’s personal information. If the request is more general, such as the allocation of TAs during the school week, you must consider providing an anonymised version.
Someone wants a copy of your bullying policy.
If you already publish this online, you should normally be able to send the requester a link. If you haven’t published it, you must consider providing it.
Someone asks whether your school buildings include RAAC.
You must handle this under the EIR.
Someone wants to know about your photocopier contract.
You must handle this under FOIA.
A parent who’s exhausted the complaints procedure now sends multiple FOI requests.
You could consider refusing these as “vexatious”, but case law has set a high bar. See our guidance on vexatious requests.
What next steps should we take?
You should ensure that everyone understands:
- how to spot a request;
- the timeframes involved; and
- who’s responsible for responding.
To get the conversation started, you could:
- share this guidance with staff across your organisation; and
- add FOI to the agenda for upcoming staff, governors or trustees meetings.
You should check that your school has a system in place for logging FOI and EIR requests and when you’ve responded. Our request-tracking template can help. You could also consider offering all-staff training on FOIA and the EIR – our training videos can help.
How can the ICO help us?
We want to support you in dealing with FOIA and the EIR. A good place to start is FOI guidance and resources, which is full of advice and practical support.
Our Guide to managing an FOI request covers all the key issues. If you’re short on time, our FOI in 90 seconds guide gives you the basics.
For specific questions, you can contact our business advice team or you can call our Helpline on 0303 123 1113.