Freedom of information in schools

Does FOI apply to schools? Who the Act covers

The Freedom of Information Act 2000 applies to maintained schools and academies because Part IV of Schedule 1 to the Act names them as public authorities. Paragraph 52 names “the governing body of” a maintained school and a maintained nursery school in England and Wales. Paragraph 52A names “the proprietor of an Academy, in respect of information held for the purposes of the proprietor's functions under Academy arrangements”, which is the academy trust. Paragraph 54 names the managers of controlled, voluntary and grant-maintained integrated schools, and of pupil referral units, in Northern Ireland.

For a maintained school the public authority is the governing body, not the headteacher. In a trust it is the board: the ICO's advice for schools on the FOIA and responding to requests for information says that at school trusts the academy trust board, as proprietor, is responsible “for compliance with FOIA and EIR, regardless of how many schools are in the trust.” A multi-academy trust is one public authority, whichever academy a request was sent to.

What the Act gives is in section 1(1): any person making a request is entitled “(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b) if that is the case, to have that information communicated to him.” Anyone means anyone – members of the public, parents, journalists, campaign groups and staff – and the Act does not require them to give a reason.

• Independent schools are not public authorities under the Act, so a fee-paying school does not have to answer an FOI request, although what it sends to a council or the Department for Education may be disclosable by them.
• Scotland has its own law, the Freedom of Information (Scotland) Act 2002, with its own commissioner. Council-run schools answer through their council, and the Freedom of Information (Scotland) Act 2002 (Time for Compliance) Regulations 2016 give grant-aided schools a school-day rule like the one below.
• The regulator for the rest of the UK is the Information Commission, which replaced the Information Commissioner on 30 September 2026 and is still known as the ICO. Its guidance for schools predates the change, so read the date on any ICO page you rely on.

What counts as a valid FOI request to a school

A valid FOI request to a school is one that is in writing, gives the requester's name and an address for correspondence, and describes the information wanted. Those are the three conditions in section 8(1) of the Act. Writing includes email and other electronic messages: under section 8(2) a request counts as written where its text “(a) is transmitted by electronic means, (b) is received in legible form, and (c) is capable of being used for subsequent reference.”

Section 8 asks for nothing else. A request does not have to mention the FOI Act, use a form, be addressed to the headteacher or explain why the information is wanted. The ICO tells schools: “A request is valid whether it's addressed to the governors, trustees, the school, or to a staff member.” So a request to a class teacher or a governor has started the clock as surely as one to the office. It helps to name a single contact in the publication scheme and to ask staff and governors to pass anything that looks like a request to that person the same day.

Three things sort a request before the clock is counted:

1. Is it the requester's own personal data? A parent asking for their own information, or a member of staff for theirs, is making a subject access request under Article 15 of the UK GDPR and the Data Protection Act 2018, not an FOI request. A parent asking to see their child's educational record may have a separate right (see the questions below).
2. Is it environmental? Information about buildings, land, energy or emissions falls under the Environmental Information Regulations 2004. The ICO's example for schools is a question about whether school buildings include RAAC: “You must handle this under the EIR.”
3. Is it clear? If the school reasonably needs more detail to identify and locate the information, section 1(3) lets it ask, and the time limit then runs from the day the clarification arrives (section 10(6)). The section 16 duty to advise and assist means helping the requester say what they actually want, not waiting for them to guess.

For a requester looking for a template, the law needs only the three things in section 8: your name, an email or postal address for the reply, and a clear description of the information, with dates and the subject where you can give them.

The FOI time limit for schools: 20 school days or 60 working days

A maintained school or academy must answer an FOI request promptly and by the 20th school day after receipt or the 60th working day, whichever comes first. For other public authorities, section 10(1) sets the limit at “promptly and in any event not later than the twentieth working day following the date of receipt”; for schools, regulations made under section 10(4) change the count.

• Maintained schools and maintained nursery schools: regulation 3 of the Freedom of Information (Time for Compliance with Request) Regulations 2004 replaces the twentieth working day with “(a) the twentieth working day following the date of receipt, disregarding any working day which, in relation to the school referred to in paragraph (1), is not a school day, or (b) the sixtieth working day following the date of receipt, whichever occurs first.” A school day is “any day on which, at the school referred to in paragraph (1) above, there is a session.” The rule also covers schools maintained by the Secretary of State for Defence.
• Academies: regulation 2 of the Freedom of Information (Time for Compliance with Request) Regulations 2010 applies the same rule to requests received by the proprietor of an academy. Where a multi-academy trust has different term dates across its schools, the ICO says “you must take account of school days for the academy the request relates to.”
• Northern Ireland: regulation 2 of the Freedom of Information (Time for Compliance with Request) Regulations 2009 gives the managers of controlled, voluntary and grant-maintained integrated schools and pupil referral units the same 20 school days or 60 working days.
• Environmental information: the school-day rule modifies only section 10 of the Act, so an EIR request is due within 20 working days, which regulation 7(1) of the Environmental Information Regulations 2004 allows the school to extend to 40 where it reasonably believes the complexity and volume of the information make 20 impracticable.

A working day, under section 10(6), is any day other than a Saturday, a Sunday, Christmas Day, Good Friday or a bank holiday “in any part of the United Kingdom”. Training days with no pupils in are working days but not school days.

A worked example. A request reaches a maintained school on a Wednesday with five school days of the summer term left after it, then a six-week holiday. Those five school days count; the holiday does not. The 20th school day is therefore the 15th day of the autumn term on which the school is in session, about 50 working days after the request arrived, so it comes before the 60th working day and is the deadline. The 60-working-day limit is a backstop for a longer closure. Neither is a target: the duty is to respond promptly, and a request that arrives in term should not wait for the holiday to run the clock down.

Log the date of receipt by the school, not the date the request reached the office. If a governor forwards on a Friday a request they received on Monday, the school received it on Monday.

Refusing an FOI request: exemptions, the cost limit and internal review

The Act covers recorded information the school holds, in any form, and nothing else: a school does not have to create information to answer a question, and if it holds nothing it says so, because section 1(1)(a) is a duty to confirm or deny. Where it holds the information, it may withhold it only under the Act's provisions. Those schools meet most often are:

• Personal data (section 40). Information about other people – pupils, parents, staff – is usually withheld or redacted. A requester's own personal data is answered as a subject access request instead.
• The cost limit (section 12). Under the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004, the limit for schools is £450, costed at £25 an hour, which is 18 hours of work. Only four activities count: establishing whether the information is held, locating it, retrieving it and extracting it. Redaction time does not.
• Information reasonably accessible by other means (section 21), such as a document already on the school's website under its publication scheme, and information intended for future publication (section 22), such as minutes the clerk will publish shortly.
• Vexatious and repeated requests (section 14). The code of practice below says section 14(1) may be used where a request, or the impact of a request, “is not justifiable or reasonable”.

A refusal must be in writing within the same time limit as an answer. Section 17 requires a refusal notice that names the exemption and says why it applies, and, under section 17(7), tells the requester about any internal review procedure and their right to complain to the ICO. When the refusal is on cost, the Cabinet Office's Freedom of Information Code of Practice (July 2018), issued under section 45, says authorities “should consider what advice and assistance can be provided to help the applicant reframe or refocus their request”, such as a narrower subject or timespan.

The same code sets the internal review: it is usual to accept a request for one made within 40 working days of the response, the review should normally be completed within 20 working days, and it is best practice for it to be done by someone other than the person who took the original decision. Paragraph 5.7 adds that authorities such as maintained schools, whose deadline is extended by regulations, “should apply the same time scales to internal reviews.” In a school the reviewer is often the chair of governors or a trustee, which needs planning before a request arrives.

Whatever the outcome, the school's log should show the date of receipt, the deadline, what was searched and by whom, the decision and the date it was sent. That record is what the internal review and the ICO will ask for.

The school publication scheme: what you must publish

Every school covered by the Act must have a publication scheme. Section 19(1) makes it the duty of every public authority “(a) to adopt and maintain a scheme which relates to the publication of information by the authority and is approved by the Commission”, “(b) to publish information in accordance with its publication scheme, and (c) from time to time to review its publication scheme.” In practice that means adopting the ICO's model publication scheme and saying what the school publishes under it.

For schools in England the ICO's definition document for the governing bodies of maintained and other state-funded schools in England (version 4.0, 29 October 2021) says what the model scheme means for a school. It is “written for the use of all schools in England that are subject to the Freedom of Information Act 2000 (FOIA), including academies and free schools”, and it sorts information into seven classes:

1. Who we are and what we do
2. What we spend and how we spend it
3. What our priorities are and how we are doing
4. How we make decisions
5. Our policies and procedures
6. Lists and registers
7. The services we offer

The document states what the ICO expects rather than a list of legal requirements: “As a minimum, the ICO expects you to make available information that is required by statute, by the Department for Education or by virtue of a funding agreement, unless the disclosure is contrary to those provisions.” It adds: “Smaller schools may alternatively use the template guide to information schools available on the ICO website. You must make clear which document you are using.”

Two further duties are easy to miss. Under section 19(2A), where someone requests a dataset, the scheme must provide for publishing it and any updated version, unless the school is satisfied that is not appropriate, and in a re-usable electronic form where reasonably practicable. And a well-kept scheme saves work: information already published can be pointed to under section 21 rather than sent again.

Many schools fall short. In its publication schemes snapshot of February 2023, the ICO found that only five of the 20 schools in its sample had adopted the model publication scheme. The statutory policies guide lists what else a school must publish.

Where FOI requests and the information they ask for actually sit

The guidance assumes a request arrives at the office and the information sits in the school's systems. Often neither is true. A parent asks a question by message to the teacher whose number they have, and adds “can you send me the figures”. A local reporter emails a governor. The request is valid whoever received it, the clock runs from that day, and the office may not hear of it for a week.

The information is the harder part. A request for everything about a decision to close a nursery class or change the uniform supplier reaches the place the decision was actually discussed, and in many schools that is the staff WhatsApp group or the governors' group rather than the minutes. Messages about the school's business can be held on its behalf even on a personal phone; how to search them, and what happens if they have gone, is set out in our guide to FOI requests and WhatsApp messages.

ComplyChat is designed to keep those conversations on the school's record. Staff, governors and parents added by their mobile number talk in channels the school or trust controls; a mobile number verified by SMS is an identity, so a governor or parent does not need an account on the school's systems; and everyone added is told the channel is on the record and can object or leave. Messages are recorded on the server as they are sent, and on paid plans, once the school's tenant is connected, conversations are kept under the retention schedules within its own Microsoft 365 subscription, alongside the school's other records. ComplyChat is not an FOI case management system or a publication scheme, and it does not decide what to disclose: the log, the redaction and the refusal notice stay with the school.

A question for the next governors' meeting: if a request arrived tomorrow by message to one of us, who would log it, who would count the school days, and could we find everything we said about the decision it asks for?

Questions people ask

Does FOI apply to schools?

Yes for maintained schools and academies: Schedule 1 to the Freedom of Information Act 2000 names the governing bodies of maintained schools and maintained nursery schools in England and Wales (para 52), the proprietor of an academy, which is the academy trust (para 52A), and the managers of controlled, voluntary and grant-maintained integrated schools in Northern Ireland (para 54). Independent schools are not public authorities under the Act. In Scotland the Freedom of Information (Scotland) Act 2002 applies instead.

Does FOI apply to academies?

Yes. Paragraph 52A of Schedule 1 makes the proprietor of an academy – the academy trust – a public authority for information held for its functions under academy arrangements, and the trust board is responsible for compliance across all its schools. Academies work to the same 20 school days or 60 working days as maintained schools, under the 2010 Time for Compliance Regulations.

How long does a school have to respond to an FOI request?

A maintained school in England or Wales, or an academy in England, must respond promptly and by the 20th school day after receipt or the 60th working day, whichever comes first, under the Freedom of Information (Time for Compliance with Request) Regulations 2004 (maintained schools) and 2010 (academies). The 2009 Regulations give grant-aided schools in Northern Ireland the same rule. Other public authorities have 20 working days under section 10. The school-day rule does not apply to environmental information: an EIR request has 20 working days, which the school may extend to 40 where the complexity and volume of the information make 20 impracticable.

Can I request to see my child's school records?

Not under FOI. A request for personal information is handled under data protection law as a subject access request. In a local-authority-maintained school in England (other than a nursery school), or a non-maintained special school, regulation 5 of the Education (Pupil Information) (England) Regulations 2005 also requires the governing body to let a parent see the educational record within 15 school days of a written request. Academies and other independent schools are not covered by regulation 5. The subject access request guide covers the data protection route.

What cannot be requested under FOI?

Anyone can ask for any recorded information the school holds, but the school may withhold it where an exemption applies – most often the requester's own or other people's personal data (section 40), information already reasonably accessible (section 21), or a request that would cost more than the £450 limit (section 12; 18 hours at £25) – and must say in a refusal notice, within the same time limit, which exemption it relies on or that the cost limit applies.

Can a school ignore a freedom of information request?

No. A school must confirm or deny whether it holds the information and either provide it or issue a refusal notice within the time limit, and a requester who gets no answer can complain to the ICO under section 50, which can issue a decision notice requiring a response.

Official guidance and your next step

The law is in the Freedom of Information Act 2000 – sections 1, 8, 10, 17 and 19 and Schedule 1 – and the 2004, 2009 and 2010 Time for Compliance Regulations and the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004. The ICO's advice for schools on the FOIA and its definition document for schools in England are the regulator's guidance, and the Cabinet Office's Freedom of Information Code of Practice covers internal reviews and the cost limit. Replies from public bodies quoted in section 04 are from WhatDoTheyKnow, as captured, classified and verified for our evidence pack on 29 October 2026. Other quotations are from the pages named as published on 29 and 30 October 2026.

This guide is a summary for schools and academy trusts, mainly in England, and is not legal advice. A request that touches a complaint, a dispute or a safeguarding matter is one to take to your data protection officer.

Then do one thing: open your school's publication scheme page and check three things – that it names the ICO model scheme or the template guide to information, that every link in it works, and that it says who a request should go to. Then ask whoever deals with information governance how a request sent to a teacher or a governor would reach the log, and on which day the clock would start.