The FOI cost limit: section 12 and the 18-hour limit

What the FOI cost limit is: section 12 and the appropriate limit

The FOI cost limit comes from section 12 of the Freedom of Information Act 2000, which says: “Section 1(1) does not oblige a public authority to comply with a request for information if the authority estimates that the cost of complying with the request would exceed the appropriate limit.” The amounts are set by regulation 3 of the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004: “In the case of a public authority which is listed in Part I of Schedule 1 to the 2000 Act, the appropriate limit is £600.” and “In the case of any other public authority, the appropriate limit is £450.”

Staff time is costed at a flat rate. Regulation 4(4) says the costs “are to be estimated at a rate of £25 per person per hour”, whatever the grade of the person doing the work, so the £450 limit is 18 hours of work and the £600 limit is 24 hours, as the ICO's guidance on section 12 – requests where the cost of compliance exceeds the appropriate limit also puts it.

Who is on which limit:

• £600, or 24 hours: the bodies in Part I of Schedule 1 to the Act – government departments (which section 84 defines to include a Northern Ireland department), the House of Commons, the House of Lords, the Northern Ireland Assembly, the Senedd, the Welsh Government, the Competition and Markets Authority (except information it holds as a tribunal), Ofsted (except information held for certain functions under the Care Standards Act 2000) and the armed forces (except the special forces and units assisting GCHQ). The Cabinet Office's code of practice shortens this to “central government departments”, but the test in the regulations is the list in Part I.
• £450, or 18 hours: every other public authority under the Act, including maintained schools and maintained nursery schools, academy trusts, councils, NHS bodies and police forces.
• Scotland has its own Act and its own fees regulations, with a £600 limit worked out differently (section 05).

Section 12 is a cost ceiling, not an exemption. It has no public interest test, and the Cabinet Office's Freedom of Information Code of Practice (July 2018), issued under section 45, says at paragraph 6.10: “The cost limit should be applied before any exemption in Part II of the Act.” The £450 and £600 amounts are those made in 2004 and are unchanged on 31 October 2026. The regulator is the Information Commission, which replaced the Information Commissioner on 30 September 2026 and is still known as the ICO; its section 12 guidance was last updated in November 2023 and still refers to the Commissioner.

What counts towards the 18 hours, and what does not

Only four activities count towards the FOI cost limit. Regulation 4(3) says a public authority “may, for the purpose of its estimate, take account only of the costs it reasonably expects to incur in relation to the request in– (a) determining whether it holds the information, (b) locating the information, or a document which may contain the information, (c) retrieving the information, or a document which may contain the information, and (d) extracting the information from a document containing it.”

The rate is the same whoever does the work. The ICO says: “Even if you use contract or external staff to carry out some or all of the permitted activities, you can only include their time at the rate of £25 per hour.” It also accepts reasonable costs other than staff time that arise in the four activities, if you can evidence them: an extra charge for retrieving files from commercial off-site storage, depending on the contract, or specialist software, where “if you can show that your existing software is unable to do the job, but that you could purchase other specialist software ... then you could include the cost of that software in the estimate.”

Anything outside the four activities stays out of the estimate, however long it takes:

• Considering exemptions. The ICO: “This means that you cannot include the time taken, or likely to be taken, in considering whether any exemptions apply.”
• Redaction. “You also can’t take account of the time likely to be taken in removing any information which you decide is exempt (often referred to as ‘redacting’ the exempt information).” Paragraph 6.4 of the code agrees: “Other factors including redaction time or any other expenses likely to occur in cost limit calculations cannot be included when estimating whether the response would exceed the cost limit.”
• Everything else in handling the request – consulting colleagues or third parties about disclosure, getting sign-off and drafting the reply – because regulation 4(3) allows only the four activities.

The estimate is made on the records as they are actually kept. The ICO says “the applicant has to take the public authority’s record-keeping practices as they are, even if they are defective”, and adds: “This applies whether your records management represents good practice or not”, although poor records management that comes to light on a complaint may draw comment in a decision notice. Nor does the ICO expect searches routinely to include recovering deleted information, particularly where nothing suggests it would turn up anything relevant.

A worked example. A requester asks an academy trust for all emails between ten named staff about a decision to restructure its finance team, over two years. A keyword search of one mailbox takes 20 minutes and returns about 120 items, each of which has to be opened to see whether it is about the restructure. A second mailbox gives a similar count. At about a minute an item, ten mailboxes is roughly 20 hours of locating and extracting, plus more than three hours of searches, before a word is redacted, so the request is over the 18-hour limit. Reading the relevant items for personal data, and the redaction that follows, would not have counted however long it took.

Making an estimate that will stand up to a complaint

A refusal on cost rests on an estimate, and the authority has to have made one. The ICO says “An estimate is more than just a guess or an assertion”, and treats a refusal with no estimate behind it as one section 12 cannot support. Paragraph 6.7 of the code sets the standard: “The cost limit can be applied on the basis of a reasonable estimate at the time the request is received. Public authorities are not under any obligation to make a precise calculation although estimates should be sensible and realistic.”

The ICO adds: “You should base the estimate on how you hold the records at the time of the request or up to the statutory time for compliance (usually 20 working days from the date of the request).” For a school or academy that time for compliance is counted in school days, as set out in our guide to freedom of information in schools.

What a sound estimate usually contains:

1. Where the information is likely to be. The systems, mailboxes, shared drives, paper files and devices a reasonable search would cover, and why.
2. A sample. Paragraph 6.8 of the code: “In some cases it may be helpful to conduct a sampling exercise to help establish likely cost but this is not essential.” Searching one or two mailboxes and timing the work turns an assertion into evidence.
3. The arithmetic. The number of places to search, items per place and minutes per item, with the activity each figure belongs to, so that nothing outside the four activities creeps in.
4. The date and the author. The ICO expects you to be able to produce that evidence if a complaint is made to it, so keep the workings with the request.

There is no duty to search up to the limit before refusing. Paragraph 6.6 of the code: “Public authorities do not have to search for information in scope of a request until the cost limit is reached, even if the applicant requests that they do so.” The ICO says you may stop as soon as you realise the limit will be exceeded, and, “As a matter of good practice, you should avoid providing the information found through any searches already conducted and then claiming section 12 for the remainder of the information.” The ICO also says a request framed by the limit itself – for whatever can be found in 18 hours – is not a valid request.

A letter with several questions is several requests. The ICO treats each as a separate request for section 12, and they can be added together only if they meet the aggregation test in section 04; the code adds at paragraph 6.6 that if one part of a request would exceed the limit, the authority need not answer the other parts.

Section 12 covers only the four countable activities. Where the real burden lies elsewhere and would be grossly oppressive – a request that would mean reading thousands of documents for exemptions – the ICO points to section 14, which lets an authority refuse a vexatious request, not to section 12.

Adding requests together: aggregation within 60 working days

Related requests can be costed together. Section 12(4) provides for regulations under which, “where two or more requests for information are made to a public authority– (a) by one person, or (b) by different persons who appear to the public authority to be acting in concert or in pursuance of a campaign, the estimated cost of complying with any of the requests is to be taken to be the estimated total cost of complying with all of them.”

Regulation 5(2) sets two conditions: the requests must “relate, to any extent, to the same or similar information”, and they must be “received by the public authority within any period of sixty consecutive working days.” A working day excludes weekends, Christmas Day, Good Friday and bank holidays in any part of the United Kingdom.

The ICO reads the 60 days more narrowly when the first request is being refused. Its approach is to allow aggregation only up to the statutory time for complying with that request, so that only further requests you receive before that deadline are added, with this example: “If the first request is received on Monday 1 September, you would have until 29 September to respond. You could aggregate the cost of complying with any further requests received up to and including 29 September with that of the first request.” A later request can still be costed together with related requests received in the 60 working days before it. That is the ICO's approach rather than the wording of the regulations, but it is the one a complaint to the ICO will be judged against.

Requests that clearly fall under different laws are not added together: “you cannot aggregate requests which clearly fall under different regimes, for example, the Freedom of Information Act, the Environmental Information Regulations or the Data Protection Act.” And two requests from the same person about unrelated subjects are dealt with separately, each against its own limit.

Refusing on cost: the notice, advice and assistance, and fees

A refusal on cost still has to say whether the information is held, if that alone can be done within the limit. Under section 12(2), the authority is relieved of the duty to confirm or deny only if “the estimated cost of complying with that paragraph alone would exceed the appropriate limit.” The ICO: “But if you know that you hold the requested information, or can establish whether you hold it within the appropriate limit, you must confirm this to the applicant.” The notice should make clear which of the two the authority is relying on: that it does hold the information but cannot provide it within the limit, or that even finding out whether it holds it would exceed the limit.

The refusal is a notice under section 17(5): an authority relying on section 12 “must, within the time for complying with section 1(1), give the applicant a notice stating that fact.” Section 17(7) requires the notice to give particulars of any internal complaints procedure, or say there is none, and of the right to complain to the ICO under section 50. There is no statutory duty to include a breakdown of the estimate, but the ICO says one is useful and helps meet the duty to advise and assist.

The duty to provide advice and assistance is in section 16(1): “It shall be the duty of a public authority to provide advice and assistance, so far as it would be reasonable to expect the authority to do so, to persons who propose to make, or have made, requests for information to it.” Following the code counts as meeting it, and paragraph 6.9 says authorities should consider how to help the requester bring the request within the limit: “This may include suggesting that the subject or timespan of the request is narrowed. Any refined request should be treated as a new request for the purposes of the Act.” The ICO warns against advice that only tells the requester to narrow the request: “Advising applicants to narrow their requests without indicating what information you can provide within the limit, will often just result in applicants making new requests that still exceed the appropriate limit.” In the worked example above, that might mean offering the emails of the two people who led the restructure, over the six months before the decision.

Fees follow the same line. Paragraph 1.21 of the code: “It is not possible to charge for any staff time where the cost of compliance falls below the cost limit (see Chapter 6). There is no obligation to comply with any request exceeding the cost limit. However, should a public authority decide to respond to a request that exceeds the cost limit on a voluntary basis it can charge for the staff time needed to do so.” Below the limit, a fee under section 9 can cover only costs such as copying and postage, under regulation 6. Above it, section 13 allows a fee within the maximum in regulation 7, which leaves out costs counted only because requests were aggregated.

Where the FOI cost limit does not apply:

• Environmental information. The Environmental Information Regulations 2004 have no appropriate limit. A request that would be too costly is considered under regulation 12(4)(b), where “the request for information is manifestly unreasonable”, and that exception applies only if, under regulation 12(1)(b), “in all the circumstances of the case, the public interest in maintaining the exception outweighs the public interest in disclosing the information”, with the presumption in favour of disclosure in regulation 12(2).
• Subject access requests. A request for the requester's own personal data is made under data protection law, not FOI, and the FOI cost limit does not apply to it; our subject access request guide covers what does.
• Scotland. Scottish public authorities answer under the Freedom of Information (Scotland) Act 2002. Regulation 5 of the Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004 sets the limit at £600 for every authority. Under regulation 3, as made, staff time “shall not exceed £15 per hour per member of staff”, and the cost of deciding whether the authority holds the information, or whether the requester is entitled to it, is not counted. The Scottish Information Commissioner is the regulator there.

Why requests for messages run over the limit

The requests most likely to exceed the FOI cost limit ask for everything said about something: a decision, a complaint, a contract. The hours go on the countable activities, locating and retrieving, and those depend on how the authority keeps its records, which the requester has to take as they are. Email at least sits in mailboxes the authority can search. Messages often do not. Where staff, governors or councillors discuss work in WhatsApp groups or texts on their own phones, there is no index to search: each person has to be identified and asked to look through their phone, and every message found has to be exported or captured before anything can be extracted. Ten people is ten separate searches. How public bodies answered requests for WhatsApp messages shows how often that ends in a refusal on cost or an answer that nothing is held, and our guide to FOI requests and WhatsApp messages covers how to search them when a request arrives.

ComplyChat is designed for the other end of that problem. Work conversations happen in channels the school or trust controls, staff, governors and parents join with a mobile number verified by SMS rather than an account on its systems, and everyone added is told the channel is on the record. Messages are recorded on the server as they are sent, and on paid plans, once the organisation's tenant is connected, they are kept under the retention schedules within its own Microsoft 365 subscription, so finding them is a records search alongside email rather than a phone-by-phone hunt. That does not put any request within the limit – a broad enough request can take more than 18 hours in any system – and ComplyChat holds nothing sent on WhatsApp or in any other app. It is not an FOI case management system, and the estimate, the notice and the decision about what to disclose stay with the authority.

A question for the next leadership or governors' meeting: if a request arrived tomorrow for everything we said about our last big decision, how many people's phones would we have to ask about, and could we write down an estimate we would be content to show the ICO?

Questions people ask

Is section 12 an FOI exemption?

No. Section 12 is a cost ceiling, not one of the exemptions in Part II of the Freedom of Information Act 2000: it has no public interest test, and the Code of Practice says the cost limit should be applied before any exemption. A refusal on cost still needs a refusal notice under section 17(5).

What elements of processing an FOI request can be considered towards the calculation of the cost limit?

Only the costs of four activities count: determining whether the information is held, locating it, retrieving it and extracting it from a document containing it (Fees Regulations, regulation 4(3)). Staff time on them is costed at £25 per person per hour (regulation 4(4)), and the ICO accepts other reasonable costs of those activities, such as specialist software needed to retrieve the information. Time spent considering exemptions or redacting cannot be counted (ICO; Code of Practice paragraph 6.4).

Do you have to pay for a freedom of information request?

Usually not. A public authority cannot charge for staff time on a request within the cost limit, and a fee under section 9 is limited to costs such as copying and postage (Fees Regulations, regulation 6). Above the limit it need not answer at all, but if it chooses to, it may charge a fee under section 13 within the maximum in regulation 7.

How many days for a FOI?

Twenty working days from receipt for most public authorities, under section 10(1) of the Act; maintained schools and academies count school days instead, as set out in our guide to freedom of information in schools. A refusal on cost has to be sent within the same time, under section 17(5).

On what grounds can an FOI be refused?

On cost under section 12 where compliance is estimated to exceed £450 (£600 for the bodies in Part I of Schedule 1 – government departments, the legislatures, the Welsh Government and the armed forces), as vexatious or repeated under section 14, or because the information is exempt under Part II of the Act. The cost limit is applied before any exemption, and a refusal on cost needs a notice under section 17(5).

What is not covered under FOI?

A request that a public authority estimates would cost more than the appropriate limit falls outside the duty to communicate the information, although the authority must still say whether it holds the information if that alone can be done within the limit (section 12(1) and (2)). The Act also covers only recorded information the authority holds; the exemptions in general are summarised in our guide to freedom of information in schools.

Official guidance and your next step

The law is in the Freedom of Information Act 2000 – sections 12, 13, 16 and 17 and Part I of Schedule 1 – and the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004, regulations 3 to 7. The ICO's guidance on section 12 is the regulator's detailed guidance, and chapter 6 of the Cabinet Office's Freedom of Information Code of Practice covers the cost limit. The Environmental Information Regulations 2004 and, in Scotland, the Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004 set their own rules. Replies from public bodies quoted in section 04 are from WhatDoTheyKnow, as captured, classified and verified for our evidence pack on 29 October 2026. Other quotations are from the pages named as published on 30 October 2026.

This guide is a summary for schools, academy trusts and other public authorities in England, Wales and Northern Ireland, and is not legal advice. A refusal likely to be challenged, or a request that touches a complaint or a dispute, is one to take to your data protection officer.

Then do one thing: open your FOI log, find the last request you refused on cost, and check that the file holds a written estimate with the places searched, a sample and the arithmetic, and that the refusal notice told the requester what could be provided within the limit.