Information not held under FOI

What “information not held” means under FOI section 1

“Information not held” is a public authority's answer to the first half of section 1(1) of the Freedom of Information Act 2000, which entitles any person making a request “(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b) if that is the case, to have that information communicated to him.” Section 1(6) calls the first part “the duty to confirm or deny”. A not-held reply is the denial: the authority has looked, and it does not hold information of that description.

Three rules in the Act decide what the authority has to look for:

• Recorded information only. Section 84 defines information as “information recorded in any form” – an email, a paper file, a database entry, a note, a text message. What someone remembers is not recorded. The ICO's guidance Determining whether we hold information says: “Information contained in someone’s mind is not recorded information and a public authority is not required to obtain information it doesn’t already hold in recorded form.”
• Held when the request arrived. Under section 1(4) the information in question is that “held at the time when the request is received”, although account may be taken of an amendment or deletion made afterwards “that would have been made regardless of the receipt of the request.” Information created after the request arrives is outside it.
• Held on the authority's behalf. Under section 3(2), information is held by a public authority if it holds it otherwise than on behalf of someone else, or if another person holds it on the authority's behalf. Records a contractor, an off-site archive or a cloud service keeps for the authority count.

A not-held reply is not a refusal notice and cites no exemption, but it is due within the same time limit as any other answer: promptly, and by the twentieth working day after receipt under section 10(1). Maintained schools and academies have the 20th school day or the 60th working day, whichever comes first, as our guide to freedom of information in schools explains.

• Scotland. Section 17(1) of the Freedom of Information (Scotland) Act 2002 says a Scottish public authority that does not hold the information “must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.” Complaints go to the Scottish Information Commissioner.
• Environmental information. The not-held answer is a refusal notice under regulation 14 citing the exception in regulation 12(4)(a) of the Environmental Information Regulations 2004. The ICO's guidance on determining whether we hold environmental information sees “no value” in a public interest test when the information is not held. In Scotland the equivalent is regulation 10(4)(a) of the Environmental Information (Scotland) Regulations 2004.
• The regulator. For the rest of the UK it is the Information Commission, which replaced the Information Commissioner on 30 September 2026 and is still known as the ICO. The ICO pages quoted here predate the change.

Held or not held: the cases that trip people up

Whether information is held is a question of fact. The ICO's guidance Information you hold for the purposes of FOIA says: “Determining whether information is held is a factual issue, rather than a question of law.” Most disputed answers turn on one of these:

• A question rather than a request for records. The ICO says: “If you don’t hold a particular piece of information that someone has asked for, you don’t have to create it. Nor are you required to ask a third party for the information, unless they hold it on your behalf.”
• Figures and lists that can be put together. “We would have to create it” is often wrong. The ICO says: “If you have the “building blocks” necessary to produce a particular type of information, it is likely that you would hold that information unless it requires particular skills or expertise to put the building blocks together.” A total or a list compiled from records already held is usually held.
• Discussed but never written down. Not held, and no one should reconstruct it to answer a request; the search has to establish whether anything about it was recorded – an email, a note, a message.
• Held by a contractor, archive or cloud service. Held, under section 3(2). The ICO says: “You must include in your searches any information relevant to the request that a third party holds on your behalf.”
• Held solely for someone else, or purely personal. Not held: paragraph 1.10 of the Cabinet Office's Freedom of Information Code of Practice, issued under section 45, says so of information held solely on behalf of another person or body and of purely personal, political, constituency or trade union information. Explain this to the requester rather than ignoring the request, the ICO says.
• Councillors. A council holds what its councillors hold as cabinet members, with executive responsibility, when representing the council or carrying out its administrative functions. The ICO says this does not include “corresponding with residents of their ward, when discussing council business with fellow councillors in the context of a voting strategy or when campaigning on behalf of their political party.”
• Trusts, schools and councils. A multi-academy trust is one public authority across its academies (paragraph 52A of Schedule 1). A maintained school's governing body (paragraph 52) and its council are separate public authorities, so each answers for what it holds and, where the other may hold the information, says so.

Reasonable searches: what the ICO expects, and how to record them

A reasonable search is one made in the places most likely to hold the information, based on how the authority actually keeps its records. Paragraph 1.12 of the section 45 Code of Practice says searches “should be conducted in a reasonable and intelligent way based on an understanding of how the public authority manages its records”, and: “If a reasonable search in the areas most likely to hold the requested information does not reveal the information sought, the public authority may consider that on the balance of probabilities the information is not held.” The code is guidance, not statute.

On a complaint the ICO does not have to prove beyond doubt whether information is held: it decides on the civil standard, the balance of probabilities – more likely than not. In Determining whether we hold information it says: “If the ICO receives a complaint disputing the amount of information you hold, we will expect you to provide a reasoned and detailed account of how you determined that you do not hold further information.” The Information Tribunal in EA/2006/0072, a 2007 decision quoted in the ICO's Information you hold for the purposes of FOIA, looked at “the quality of the public authority's initial analysis of the request, the scope of the search that it decided to make on the basis of that analysis and the rigour and efficiency with which the search was then conducted.” The ICO does not decide whether you should hold something, only whether you do, but “the stronger the indications that you should hold a particular piece of information, the better explanations you will need to provide as to how you determined that you do not hold it.”

A search that will stand up to an internal review or a complaint:

1. Read the request before searching. Settle what it asks for before deciding where to look; if that is unclear, ask under section 1(3), with the advice and assistance section 16 requires.
2. Work out where the information would be. Who would have created or received it, which system it would sit in, whether there was a business or legal reason to keep it, what the retention schedule says, and whether a contractor holds anything on your behalf – and whether it has been asked, which the ICO checks in an investigation.
3. Search those places, not every file. The ICO's learnings from ICO decision notices say: “You are not expected to search every file, but you are expected to conduct searches of areas where the information is likely to be.”
4. Do not rely on one person's memory. In decision notices IC-383350-L7F2 and IC-377138-H1C8 the ICO required fresh searches and fresh responses where one authority had simply asserted poor record keeping and the other had relied on a staff member's memory of what was held.
5. Write it down as you go. The ICO calls it good practice to keep a record of searches: “You should record the areas of the organisation that you searched and the staff you consulted. If you conduct electronic searches, you should keep a record of the keywords, accounts and time parameters used.”

A search record need not be long: the date received and the deadline; any clarification sought; each system, mailbox, drive, paper file and archive searched, by whom and when; the staff asked and what they said; the keywords, accounts and date ranges used; anything deleted, with the retention rule or destruction record that explains it; and who made the decision. That record is what an internal reviewer, and then the ICO, will ask to see.

Deleted, amended and backed-up information

Information destroyed before the request arrived is not held. The ICO's guidance on retention and destruction of information says: “If you receive a request for information that you held in the past, and has now been destroyed, you no longer hold that information. In order to comply with FOIA or the EIR, you only need to reply stating you do not hold the information.” The same page still expects the section 16 help: advice on whether the information may be available elsewhere, and any related information you hold.

Be able to say why it has gone. The records management code under section 46, as the ICO quotes it, says: “Authorities must be able to explain why information is no longer held either by reference to a record of its destruction or by reference to the authority’s policy.” A retention schedule that is followed, and a log of what was destroyed and when, is that explanation; our guide to data retention policies covers deletion and proving it happened.

Deleted is not always gone. The ICO says: “If you held the deleted information electronically and it has not been permanently overwritten or is recoverable, you may still hold that information for the purposes of the legislation.” Its guidance on determining whether information is held adds that information “is only completely erased and therefore not held once it has actually been overwritten”, so a copy in a recycle bin, a deleted-items folder or elsewhere on the server may still be held. Backups are where the guidance pulls two ways:

• The tribunal in EA/2013/0262, as the ICO quotes it, said that “if requested information is in (or on) back-up tapes which are themselves held by the public authority or is in some other way still stored on the public authority’s server, we consider that it is clearly “held” by the public authority.”
• Paragraph 1.11 of the section 45 code says a search for information deleted before a request is received, and held only in electronic backup files, “should generally be regarded as not being held.”
• The ICO's guidance narrows the gap in practice: “The ICO considers that it would be unreasonable for you to restore your system from backup every time you receive an information request, just in case you may hold some information.” The cost of recovery can be taken into account, and where nothing suggests significant information was deleted, a search of live systems and maintained archives is likely to be enough.

Routine deletion can carry on while a request is open, as section 1(4) allows, and the ICO says: “You won’t usually have to release information under FOIA if it is scheduled to be destroyed under your usual disposal schedule before the time for compliance with the request expires.” Deletion prompted by the request is different: altering, erasing or concealing a record with the intention of preventing its disclosure is an offence under section 77, which our guide to FOI requests and WhatsApp messages covers, with disappearing messages.

Writing the not-held reply, and handling a challenge

The ICO's request handling FAQ says a first response should state that the request “has been dealt with under FOIA”, confirm whether the information is held, explain the internal review process and tell the requester of their right to complain. A not-held reply that will settle the matter usually has seven parts:

1. That the request was handled under the Freedom of Information Act (or the EIR, or the Scottish Act).
2. That the information is not held, part by part where the request has several parts.
3. Why, where you can say. The ICO says: “It is good practice to explain, if you can, why you consider that you do not hold the requested information. Clearly demonstrating why you do not hold a particular piece of information means the requester is less likely to ask for an internal review or complain to the ICO.”
4. What was searched, summarised from the search record: the systems, the people asked, the keywords and the dates.
5. Related information you do hold and can provide, under the section 16 duty to advise and assist.
6. Who else may hold it. Paragraph 2.12 of the code says the reply should say the information may be held by another public authority and, “as best practice where they can, provide the contact details” for it. Under paragraph 2.13 a request is transferred to another authority “only with the applicant's agreement”.
7. How to ask for an internal review, and the right to complain to the Information Commission.

Not held, “neither confirm nor deny” and an exemption are different answers. “Neither confirm nor deny” is available only where an exemption in Part II removes the duty to confirm or deny (section 2(1)); it is not a softer way of saying not held. Otherwise an authority must say whether it holds the information unless it is relieved of the whole request – under section 12(2) where the cost of confirming or denying alone would exceed the appropriate limit, or section 14 for a vexatious or repeated request – or is waiting for clarification it reasonably needs. And the ICO warns: “Do not cite exemptions for information unless you have actually located the information and confirmed that it falls within the scope of the request.”

A requester who doubts a not-held answer asks for an internal review first, which is a code of practice step rather than a statutory right, then can apply to the Information Commission under section 50. The Commission need not decide a complaint where the requester has not exhausted the authority's own complaints procedure (section 50(2)(a)). Where it finds a failure to confirm or deny, its decision notice must specify the steps the authority must take and by when – often fresh searches and a fresh response. What regulators and tribunals have found includes cases where an authority said messages were not held and the regulator disagreed. In Scotland the complaint goes to the Scottish Information Commissioner.

Two worked examples, both invented for illustration; neither describes a real trust, council or school:

• An academy trust. A parent asks a multi-academy trust for the emails between two of its headteachers about changing the school day. The trust is one public authority, so its governance lead searches both heads' mailboxes and the project's shared folder for the six months before the change, and asks each head whether anything was sent another way. Nothing turns up beyond the letter already sent to parents. The reply says the emails are not held, lists the mailboxes, keywords and dates searched, and links to the letter.
• A council. A resident asks a council for a ward councillor's messages with a school's governors about a planning application. The FOI team asks planning officers, democratic services and the councillor. The councillor sent them as an elected ward member, not in a council role, and the ICO says a council does not hold what councillors hold in that capacity. The reply says so, and because the maintained school's governing body is a separate public authority, gives the school's contact details for anything the governors hold.

When the decision was discussed, but not where anyone can search

The not-held answers that are hardest to give with confidence are about conversations: the minutes record the outcome of a decision, but the discussion happened in a leadership group, a staff chat or the governors' WhatsApp group, on personal phones. A message there about the organisation's business may be held on its behalf, and the search becomes a round of asking each person to look through their own phone. How to search messages you do not hold has its own guide, and how public bodies answered requests for WhatsApp messages shows how often that round ends in “not held”.

ComplyChat is designed to keep those conversations on the organisation's own record from the first message. Staff, trustees and governors talk in channels the trust or school controls; a mobile number verified by SMS is an identity, so nobody needs an account on its systems; and everyone added is told the channel is on the record and can object or leave. Messages are recorded on the server as they are sent, not gathered from handsets afterwards, and on paid plans, once the tenant is connected, conversations are kept under the retention schedules within the organisation's own Microsoft 365 subscription. A request is then answered from the organisation's own record, and the channels searched go into the search record like any other system.

ComplyChat is not an FOI case management system, it does not decide whether information is held or should be disclosed, and it does not remove the need to search: email, paper files, other systems and a conversation in a corridor are still where they were. What it changes is whether the messages about a decision sit somewhere the organisation can search at all.

A question for the next board or senior leadership meeting: the last time we answered “not held”, could we show where we searched – and were the conversations about that decision anywhere we could have searched?

Questions people ask

What does “information not held” mean in an FOI response?

It means the public authority has searched and does not hold recorded information of the description in the request as at the date it was received – its answer to the duty to confirm or deny in section 1(1)(a) of the Freedom of Information Act 2000. It cites no exemption, but is due within the same time limit as any other reply.

Can I challenge an FOI response that says the information is not held?

Yes. Ask the authority for an internal review first, then apply to the Information Commission (the ICO) under section 50, which need not decide a complaint until the authority's own complaints procedure has been exhausted. The ICO decides on the balance of probabilities by looking at whether the search was reasonable, and can require fresh searches and a fresh response. In Scotland, complain to the Scottish Information Commissioner.

Does a public authority have to create information to answer an FOI request?

No. The Act covers only information already held in recorded form when the request arrives. But if the authority holds the “building blocks” and putting them together needs no particular skills or expertise, the ICO says it is likely to hold the information.

Is deleted information “held” for FOI?

Information destroyed before the request arrives is not held. The ICO's view is that deleted information still recoverable from a recycle bin, server or backup may still be held, though it does not expect a restore from backup for every request; the section 45 code says backup-only copies should generally be regarded as not held.

What is the difference between “not held” and “neither confirm nor deny”?

“Not held” answers the duty to confirm or deny with a denial. “Neither confirm nor deny” is available only where an exemption removes that duty (section 2(1)), usually because saying whether the information exists would itself disclose something. Neither is a substitute for the other.

Official guidance and your next step

The law is in the Freedom of Information Act 2000 – sections 1, 2, 3, 10, 12, 14, 16, 50, 77 and 84 and Schedule 1 – with section 17 of the Freedom of Information (Scotland) Act 2002 and regulation 12(4)(a) of the Environmental Information Regulations 2004. The Cabinet Office's Freedom of Information Code of Practice (2018), paragraphs 1.10 to 1.12 and 2.12 to 2.13, covers searches and redirection, and the ICO's guidance pages linked above are the regulator's detailed guidance. Replies from public bodies quoted in section 03 are from WhatDoTheyKnow, as captured, classified and verified for our evidence pack on 29 October 2026. Other quotations are from the pages named as published on 30 October 2026.

This guide is a summary for public authorities in England, Wales and Northern Ireland, with notes for Scotland, and is not legal advice. A not-held answer that touches a complaint, a dispute or a safeguarding matter is one to take to your data protection officer or legal adviser.

Then do one thing: take the last request you answered “not held” and check whether the file shows where you searched, who you asked, and the keywords and dates you used. If it does not, add those headings to your request log before the next one arrives.