Understanding and Challenging FOI Refusals | UK JournoHub

Last reviewed: 17 May 2026Next review due: 17 November 2026

How FOI refusals work

When a public authority refuses a Freedom of Information request, it must issue a refusal notice that complies with Section 17 of the FOIA 2000. A valid refusal notice must: cite the specific exemption(s) relied upon; for qualified exemptions, explain the public interest test and why the interest in withholding outweighs the interest in disclosure; and advise you of the right to seek an internal review and to complain to the ICO. A refusal that does not meet these requirements is itself a breach of the Act and gives you an immediate ground for challenge.

Authorities can refuse in several ways: a full refusal (all information withheld), a partial refusal (some information provided, some withheld), or a “neither confirm nor deny” response (declining to say whether information is held). Each has different implications for your challenge strategy. In all cases, do not simply accept the refusal — read it carefully, identify its weaknesses, and respond systematically.

Types of FOI refusal

Full refusal

All information withheld under one or more exemptions. The authority must cite each exemption and apply the public interest test to each qualified one.

Partial refusal

Some information disclosed, some withheld. The withheld parts must be subject to a valid refusal notice. You can challenge just the withheld parts.

Neither confirm nor deny

The authority declines to say whether it holds the information. Only valid where confirming or denying would reveal exempt information. Narrowly interpreted.

Common bad-faith refusal patterns

1
Vague "personal data" claims
Section 40 is applied to aggregate statistics, job titles, role-based pay scales, or anonymised records — none of which constitute personal data.
2
"Vexatious" misuse
Section 14 is claimed against persistent journalists or campaigners making legitimate requests on matters of public interest.
3
Cost limit with no calculation
Section 12 is cited but no estimate of the compliance cost is provided — making it impossible to assess whether the refusal is justified.
4
"Future publication" with no timetable
Section 22 is used to delay indefinitely with no publication date or commitment given.
5
s.36 without a qualified person
Effective conduct of public affairs is cited but the authority cannot or will not identify who the "qualified person" is or what they considered.
6
Stacking exemptions
Multiple exemptions are cited as a belt-and-braces approach with no specific analysis of whether each applies to which piece of information.
7
Wrong public interest test
The authority applies the public interest test by listing the categories of interest rather than by analysing the specific information and the specific public interest at stake.

Red flags in a refusal notice

The exemption is cited by name but not by section number — check the Act to confirm it exists as described.
No public interest test reasoning is provided for a qualified exemption — this is a breach of s.17.
The public interest test is generic and does not refer to the specific information requested.
The refusal letter does not advise you of your right to an internal review — required by s.17(7).
The refusal covers the entire request without specifying which exemption applies to which information.
The authority says the information is "not held" without explaining why or offering to check related records.
The refusal arrives after the 20-working-day deadline — late refusals are still refusals but carry additional weight in an ICO complaint.

Refusal response checklist

I have read the full refusal notice and identified every exemption cited.
I have noted whether each exemption is absolute or qualified.
For each qualified exemption, I have checked whether a public interest test reasoning was provided.
I have assessed whether the information actually falls within the scope of each cited exemption.
I have checked whether the refusal notice advises me of internal review and ICO complaint rights.
I have considered whether narrowing or splitting my request would avoid the exemptions.
I have drafted an internal review request citing the specific weaknesses in each exemption application.
I have set a calendar reminder for the internal review deadline (20 working days, up to 40 for complex cases).

Build your internal review request

Our FOI Appeal Builder takes you through each exemption and generates a targeted internal review request with the correct legal arguments. Pair it with our Internal Review Template for the right format.

Open FOI Appeal Builder Internal Review Guide

Common mistakes when responding to refusals

Accepting the refusal without reading the exemption's legal requirements — many refusals are defective on their face.
Not requesting an internal review — this is a prerequisite for an ICO complaint (except for missed deadlines).
Leaving the internal review request too vague — state specifically which exemption is wrong and why.
Narrowing the request without preserving your right to challenge the original refusal.
Treating a partial disclosure as a full win — the withheld parts may still be challengeable.
Missing the window for an ICO complaint — the ICO expects complaints within a reasonable period of the internal review outcome.
Conflating the internal review request with a complaint — keep them formal and focused on the legal question.

Related guides

FOI Exemptions Explained

Every exemption from s.12 to s.44 — what it covers, how it is abused, and how to challenge it.

Internal Review Guide & Template

The first step in the formal challenge process after a refusal.

Complaining to the ICO

How to escalate to the Information Commissioner after a failed internal review.

FOI Templates Library

Includes an Internal Review template and a Refusal Challenge template.

Primary sources

Frequently asked questions

What must a refusal notice contain under Section 17?

Section 17 of the FOIA 2000 requires a refusal notice to: (1) state the fact of refusal; (2) specify the exemption(s) relied upon; and (3) for qualified exemptions, state why the public interest in maintaining the exemption outweighs the public interest in disclosure. It must also advise you of the right to seek an internal review and the right to complain to the ICO. A refusal notice that fails to meet these requirements is itself a breach of the Act — you can challenge the refusal on procedural grounds alone.

What is a "neither confirm nor deny" response?

Under s.1(1)(a), authorities are normally required to confirm or deny whether they hold the information you have requested. A "neither confirm nor deny" (NCND) response is a special kind of refusal that declines to say whether the information exists. It is only permitted when confirming or denying would itself reveal exempt information — most commonly where s.23 (security bodies) applies. NCND is not a blanket tool and must be justified with the same rigour as a full refusal. Challenge it if you believe the authority is using it to avoid engaging with the substance of your request.

How do I challenge a Section 12 cost limit refusal?

A Section 12 refusal must include an estimate of the likely cost of compliance and must confirm that the cost exceeds the appropriate limit (£450 or £600). If the authority has not provided this estimate, ask for it. If you believe the estimate is inflated, challenge it — the ICO has found that authorities sometimes over-estimate compliance costs. You can also offer to narrow your request: ask the authority what specifically would bring the cost within the limit, then refine your request accordingly. Note that if the authority refuses under s.12, it is not required to apply any exemptions — so narrowing the request may open up information you could not otherwise access.

What is a partial refusal and how should I respond?

A partial refusal is where the authority provides some of the requested information but withholds other parts under an exemption. It must still issue a valid refusal notice for the withheld parts, citing the specific exemption per piece of information. You should read the partial response carefully and assess whether the withheld parts could be obtained by other means (narrow the request, EIR, data protection access request) and whether the exemption applied to each withheld part is properly justified. You can request an internal review of just the withheld parts while publishing the disclosed information.

Can I challenge a Section 14 "vexatious" refusal?

Yes, and you often should. Section 14 permits authorities to refuse requests that are "manifestly unreasonable" — in practice, vexatious. The ICO has established that persistence in pursuing a legitimate story is not vexatiousness. Relevant factors include: whether the request has a serious purpose, whether it imposes a disproportionate burden on the authority, whether the requester has harassed the authority, and whether the request is designed to cause disruption rather than to obtain information. Challenge a s.14 refusal by demonstrating the legitimate public interest purpose of your request and by pointing to the ICO's guidance on what does and does not constitute a vexatious request.