The Freedom of Information (FOI) Act

The Freedom of Information Act (FOI Act) mainly covers public authorities like government departments, councils and health bodies. However, it can affect private businesses that deal with them through grants, licences, tenders or contracts.

Does the Freedom of Information Act apply to private companies?

Not directly, but it can apply if:

• you share information with a public body that is subject to an FOI request
• the information you share is published under their publication scheme

What is a Freedom of Information (FOI) request?

Under the FOI Act, anyone can ask a public authority for recorded information they hold, including details from businesses carrying out public functions, such as utility providers. This right applies to all information held, including emails, reports and contracts, and not just official records. If you contract with a public body, your intellectual property and confidential data could be included under the FOI request, if this type of information is on their record.

How can FOI disclosure affect your business?

If the public body receives an FOI request for information that relates to your business, they may need to disclose certain details. This can affect your commercial interests- for example, by revealing pricing, strategies or customer data to competitors.

A public body must normally consult you first in a 'third-party consultation' before they release your information. They will explain the requested information, why they plan to release it and what harm it might cause to your business. You can then respond with arguments against disclosure, such as commercial sensitivity. The body must consider your views before deciding.

Exemptions to FOI disclosure

Certain types of information are exempt under the law. For example, financial records or contract details may be exempt from disclosure if they prejudice someone's commercial interest. Exemptions may also apply to requests for third-party personal data, under the UK General Data Protection Regulation (UK GDPR). See more on FOI exemptions: absolute and qualified.

When sharing information with regulators or public bodies, consider their Freedom of Information obligations and the possible risk of disclosure.

Public authorities may refuse Freedom of Information (FOI) Act requests under certain conditions. For example, if requests:

• cost too much or take too long to process
• are vexatious
• repeat an earlier request from the same person

They can also apply exemptions to withhold information or refuse to confirm it exists.

Some exemptions relate to a certain type of information, eg information on government policies. Other exemptions can apply if harm would arise, or be likely to arise, from disclosure.

Absolute exemption under the FOI Act

These let public authorities withhold information without a public interest check. Examples include:

• national security matters
• information banned from disclosure by other laws
• if disclosure would result in a breach of confidence that could lead to legal action

Most FOI exemptions are not absolute. Many exemptions require public bodies to consider public interest before releasing information.

Qualified exemption under the FOI Act

Most exemptions are qualified. This means that public authorities must apply a public interest test and disclose information unless withholding it serves a greater public interest.

Examples of qualified exemptions include that are relevant to business include:

• commercial interests (section 43)
• sensitive business information
• trade secrets

See a full list of FOI exemptions and read more about the FOI and commercially sensitive information.

FOI and data protection

Under the UK General Data Protection Regulation (UK GDPR), if someone's FOI request involves revealing third-party personal data, public bodies must check if disclosure is fair, lawful and necessary. If it's not, or if it's disproportionate, the information will be exempt.

Read more about the data protection principles under the UK GDPR.

The Freedom of Information (FOI) Act covers public authorities, but it can also affect private businesses that contract with the public sector, or provide goods and services to public bodies. 

Your sensitive information shared under a contract may, in this case, be subject to an FOI request. Information that harms commercial interests is exempt from disclosure under section 43 of the FOI Act (a qualified exemption).

What counts as a commercial interest?

Any information affecting your ability to compete, such as pricing, strategies or supplier details, counts as a commercial interest. Before releasing such information, public bodies must check if disclosure would cause real or likely harm to commercial interests. They do this through a test of prejudice.

Prejudice to commercial interests

To claim exemption for prejudice to commercial interests, you must show:

• a specific negative impact from disclosure
• that impact is significant (real, actual or of substance)
• a real possibility (or likelihood) that the harm will occur because of disclosure

Businesses provide evidence during third-party consultation to support the case, but the public body decides if the criteria are met (specific harm, significant impact, real possibility).

Trade secrets and the FOI

Under the FOI Act, trade secrets could potentially be exempt from disclosure. The Act doesn't define the term 'trade secret'. The term can cover, for example, technical information (invention, processes, recipes) and business information (supplier lists, costs, pricing or product development plans, etc).

To constitute a trade secret, information should require the highest level of secrecy and not be: 

• generally known
• widely disseminated
• simply confidential, but confer a competitive advantage to the owner

Section 43 is generally the primary exemption that specifically covers trade secrets, and any information that would prejudice the commercial interest. Section 43 is a 'qualified exemption', which means the public authority must balance the harm of disclosure against the public interest in releasing the information.

Find out more about section 43 - trade secrets and prejudice to commercial interests.

Section 41 can sometimes be used to protect information provided in confidence, including trade secrets, if they were provided to a public authority by a third party. Section 41 is an 'absolute exemption', meaning there is no requirement to perform a public interest test.

Find more information on section 41 - confidentiality.

The Freedom of Information (FOI) Act applies to public sector bodies. If your business provides goods or services to them, any shared information could be at risk of disclosure through an FOI request.

Information at risk of FOI disclosure

Types of information at risk of disclosure under the FOI Act include, for example:

• reports, annual returns and investigations you provide to public bodies
• public tenders or contracts details
• public consultations responses
• information relating to planning or development

Public authorities may also hold your financial records or other commercially sensitive data, which could qualify for exemption. See FOI and commercially sensitive information. 

How to manage the risk of FOI disclosure

You cannot remove all risks associated with sharing information with public bodies, but you can take the following steps to reduce them.

Label information as 'confidential' or 'restricted'

If the information is confidential or commercially sensitive, think carefully if it is necessary to disclose it. If it is, mark it clearly as 'confidential' or 'restricted'. Submit it separately from other data to avoid accidental disclosure. Keep in mind that simply labelling information 'confidential' does not guarantee exemption.

Include consultation rights in contracts

Agree consultation rights in your contracts with public bodies, ie the right to be informed before any disclosures, so you can object before information goes public. Avoid blanket confidentiality clauses and tailor terms and conditions to FOI risks to minimise any impacts.

Train staff and set procedures

Train staff on FOI requirements, data protection and the potential risk of information disclosure. Create policies and procedures for sharing data with public bodies. Track what you share with them, review it regularly, and assign FOI responsibility to a named person or team within the business.

Understand exemptions

If someone makes an FOI request about your business, a public authority may have to release the information unless an exemption applies. It is worth understanding how exemptions work to know how to object during consultation and argue against the release of sensitive business data.

FOI brings both risks and opportunities for your business. While disclosure of sensitive details could put your business at risk, FOI lets you request useful information from public bodies, such as details of procurement criteria and tender process, decisions, previous contract awards and supplier details, and even competitor bids on business contracts. Find out how to use FOI to your business advantage.

Public sector organisations may hold information that is relevant to your business or industry. For example, information on their procurement processes, previous bid proposals or existing public contracts, and even information on your competitors. You have the right to request this information under the Freedom of Information (FOI) Act.

Exemptions may limit what you receive, if disclosure would result in someone's personal details or commercial secrets being revealed.

Before making an FOI request

Before you make a request, check if the information is already in the public domain (eg on the public body's website or publication scheme).

You should not make requests for your own personal data under the FOI provisions. Instead, make a subject access request under the UK General Data Protection Regulation.

How to make an FOI request

Any request you make for information under the FOI Act must be made in writing and include:

• your name
• your contact details (postal or email address)
• clear details of the information needed and preferred format

See how to access information from a public body.

What happens when you make an FOI request?

Public authorities must reply within 20 working days. They may:

• give you the information you asked for
• tell you if they don't have the information
• redirect your request to another authority, if needed
• charge a fee if allowed (rules apply)
• withhold information under an exemption and explain why
• tell you they need longer to respond - up to 40 days for public interest cases

Find ICO's guidance on time limits for compliance under the FOI Act.

Requests are handled 'applicant blind' - your identity and purpose do not matter.

Private businesses are not directly subject to the Freedom of Information (FOI) Act. You are unlikely to receive requests unless you hold information on behalf of a public body, such as under a contract.

If you receive an FOI request

Forward it to the public authority you work with and discuss their expected response. They remain responsible for replying, normally within 20 working days.

If you're asked to assist with an FOI request

Provide any relevant information you have that the public authority may need for their reply. They will guide you on what they need, handling process and timelines, and any exemptions that may apply.

If you're asked to assist with an FOI request, it may help to understand more about the public authority's duty to respond.