FOI in Scotland: answering requests under the Freedom of Information (Scotland) Act

The rule: the Freedom of Information (Scotland) Act 2002

Section 1(1) of the Freedom of Information (Scotland) Act 2002 (FOISA) sets the general entitlement: “A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.” Section 73 defines information as “information recorded in any form”, so the right reaches documents, emails and messages, but not a view nobody has written down.

The right belongs to anyone. The Scottish Information Commissioner's Who can I ask? page puts it plainly: “You don't have to mention FOI (although you can), nor do you have to give any reasons for asking, or say why you want the information. You don't even have to live in Scotland.” What the requester gets is what the authority held when the request arrived. Section 1(4) fixes it as the information “held by it at the time the request is received”, allowing only an amendment or deletion “which would have been made, regardless of the receipt of the request”.

The Act is enforced by the Scottish Information Commissioner, an office created by section 42 of FOISA. The Commissioner, not the UK Information Commission (still known as the ICO), decides appeals about requests to Scottish public authorities. UK-wide bodies that operate in Scotland are a different matter: the Commissioner's FOI law page says that for information from “UK-wide public authorities which operate in Scotland, such as the BBC or the Ministry of Defence, you should contact the UK Information Commissioner's Office (ICO).”

Environmental information follows a parallel regime, the Environmental Information (Scotland) Regulations 2004. It reaches more organisations, and the Section 60 Code notes that “a purely verbal request for environmental information does create a statutory obligation on an authority, whilst a similar verbal request for other types information does not directly create a similar obligation.”

Who must answer: councils, schools and designated bodies

Section 3(1) of FOISA defines a Scottish public authority as a body listed in Schedule 1, a body designated by order under section 5, or a publicly-owned company: under section 6, one wholly owned by the Scottish Ministers or by a listed authority. For schools, charities and care, that means:

• Councils, for everything they do. Schedule 1 lists every council (paragraph 21), and the Commissioner's page lists “local authorities (councils) for all their functions, including education, housing, roads, waste, etc.”, with Health and Social Care Partnerships. Care and social work services a council runs itself are among those functions. A council-run school is not an authority in its own right: a request about it is a request to the council, which answers it, usually with the school's help.
• Grant-aided schools, independent special schools and secure accommodation services, designated from 1 September 2016 by the Designation of Persons as Scottish Public Authorities Order 2016. Each is designated for a function, such as “the running of a grant-aided school” or “the provision of a secure accommodation service”, not for everything the body does.
• Council leisure, sport and culture trusts, designated from 1 April 2014 by the Designation Order 2013: bodies “established or created solely by one or more local authorities” to deliver recreational, sporting, cultural or social facilities and activities, financed “wholly or in part” by those authorities.
• Registered social landlords, for their housing functions, from 11 November 2019, by the Designation Order 2019.
• Colleges, universities and the national education bodies. Schedule 1 lists Scottish colleges and universities. Qualifications Scotland was added on 1 February 2026, when the SQA's entry was repealed, and the entry for His Majesty's Chief Inspector of Education in Scotland changed on 1 March 2026, both under the Education (Scotland) Act 2025.

Other independent schools are not designated, and no private or voluntary care provider is designated apart from secure accommodation services, so on our reading of Schedule 1 and the designation orders they are outside the Act, unless one is a company wholly owned by a public authority under section 6. The Commissioner's examples of bodies not subject to FOI include “Individual Members of the Scottish Parliament (MSPs) and elected councillors” and “Companies that are not wholly publicly owned”, and it says “Most charities and voluntary organisations are not subject to FOI law, but there are some important exceptions - such as local authority leisure, sports and cultural trusts”.

A body outside the Act can still be part of an answer. Under section 3(2)(b), information is held by an authority if it is held “by a person other than the authority, on behalf of the authority.” Where a charity or care provider holds information on a council's behalf, for example under a contract, that information counts as held by the council, so the council may need to ask the provider for it to answer a request.

Answering a request: a valid request and the 20 working day clock

Section 8 of FOISA makes a request valid if it is in writing or in another form “capable of being used for subsequent reference”, “states the name of the applicant and an address for correspondence” and “describes the information requested”. Email counts, and so can a message to an official social media account: paragraph 4.3.1 of the Section 60 Code says authorities with such accounts “must be alert to the possibility of receiving valid requests for information through these channels”. A request need not mention FOI, but it cannot be anonymous: the Commissioner's validity checklist on its Appeal to the Commissioner page asks for “your real name and an address for correspondence”, and paragraph 4.3.3 of the Code accepts the requester's “full name or an initial/title and surname”.

Section 15(1) adds a duty to “provide advice and assistance” so far as it is reasonable to expect it, and section 15(2) says an authority that conforms with the Section 60 Code on advice and assistance is taken to comply with that duty.

The deadline is in section 10(1): the authority “must comply promptly; and in any event by not later than the twentieth working day after” it receives the request. A working day under section 73 is any day other than a Saturday, a Sunday, Christmas Day or a bank holiday in Scotland, and the Commissioner's How long will I have to wait? page says “The first working day of your request is the day after the date on which the authority receives it.” Two things move the clock:

• Clarification. If the authority needs more detail to identify and locate the information, and tells the requester what it needs, section 1(3) means that, provided the requirement is reasonable, it need not answer until it has the detail, and the 20 working days run from receipt of the further information (section 10(1)(b)).
• A fees notice. Under section 10(3), the working days from the day a fees notice is given to the day the fee is received are disregarded.

Grant-aided and independent special schools have a school-day rule. Regulation 2(2) of the Freedom of Information (Scotland) Act 2002 (Time for Compliance) Regulations 2016, in force since 1 December 2016, sets their deadline as the twentieth working day disregarding days that are not school days, or the sixtieth working day, “whichever occurs first”, for requests and reviews alike. The rule does not apply to council-run schools, whose council keeps the ordinary 20 working days, and paragraph 9.1.5 of the Code adds that the regulations “do not relieve those schools of their obligation to reply to a request or review ‘promptly’.”

Within the same time the authority gives the information, or one of three notices:

• A refusal notice under section 16 where it claims an exemption. The notice discloses that the authority holds the information, states that it claims the exemption, specifies which, and states (if not otherwise apparent) why it applies, with the public interest reasons where the exemption is not absolute.
• A notice that the information is not held under section 17, the subject of information not held under FOI.
• A notice that the request is vexatious, or repeats an identical or substantially similar request already answered without a reasonable interval between them. The ground is section 14, and the notice is given under section 16(5).

Section 19 says each of those notices “must contain particulars” of the authority's complaints procedure and of the rights to ask for a review and to apply to the Commissioner.

Fees and the £600 cost limit

Section 12(1) of FOISA means an authority need not comply with a request where it estimates the cost “would exceed such amount as may be prescribed in regulations”, and regulation 5 of the Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004 prescribes £600. Under regulation 3, staff time “shall not exceed £15 per hour per member of staff”, and no account is taken of the cost of deciding whether the authority holds the information or whether the requester is entitled to receive it.

Fees, where charged at all, are small. Regulation 4 says “Where the projected costs do not exceed £100, no fee shall be payable”, and above that, up to £600, “the fee shall not exceed 10% of the difference between the projected costs and £100.” The Commissioner's What might it cost? page does the sum: “So the maximum an authority could charge you would be £50.”

Above £600 the authority may refuse, but it does not have to. The same page says “Authorities can choose to respond to requests which cost more than £600 if they want to, but they may first ask you to pay the full cost above the £600 limit”, and that an authority refusing on cost “should offer to advise you how to reduce the cost by making changes to your request.” These are not the English rules: the 18-hour limit for schools, academies and councils in England, Wales and Northern Ireland is in the FOI cost limit.

Review and appeal: 40 working days, then the Commissioner

A requester who is dissatisfied “may require the authority to review its actions and decisions in relation to that request” (section 20(1) of FOISA), and section 20(9) counts “inaction and failure to reach a decision” among them. The requirement for review is in writing or another permanent form, gives the applicant's name and an address for correspondence, and specifies the request and what the requester is unhappy about (section 20(3)).

The time for asking needs care. Section 20(5) says a requirement for review must be made “by not later than the fortieth working day after” the expiry of the time allowed for answering the request (the 20 working day deadline) or, where the authority answered late, after the requester received that late response. The Commissioner's Asking for a review page tells requesters to ask “no later than 40 working days after the date you receive one of the above responses”, which is always in time and safe advice for a requester. An authority should not apply that simpler wording to turn a review away: a requester answered on day 5 has until 40 working days after day 20, not after day 5. Section 20(6) also lets an authority accept a late requirement “if it considers it appropriate to do so”.

The authority then “must ... comply promptly; and in any event by not later than the twentieth working day after receipt by it of the requirement” (section 21(1)). The revised text on legislation.gov.uk still shows “sixtieth” beside “twentieth” there; that was a temporary change, made from 7 April 2020 by the Coronavirus (Scotland) Act 2020, whose schedule 6 paragraph 3 was repealed on 27 May 2020 by the Coronavirus (Scotland) (No.2) Act 2020. The Commissioner's FOI law page describes those changes as temporary, “including - for a short period - extending the maximum timescales for responding to requests”. The review may confirm, change or replace the decision; the notice gives the reasons (section 21(4) and (5)) and “must contain particulars about the rights of application to the Commissioner and of appeal conferred by sections 47(1) and 56” (section 21(10)).

A requester still dissatisfied can apply to the Commissioner under section 47 within six months of receiving the review notice, or of the date the review was due; section 47(5) lets the Commissioner consider a late application. The Commissioner's Appeal to the Commissioner page says “it's taking up to nine months to allocate cases for investigation at present”, and that if the authority answers the review before the 20 working days are up, “you can go straight to the Commissioner.” The Commissioner's decision can be appealed to the Court of Session on a point of law only, under section 56.

Searches, WhatsApp and the 2026 Section 60 Code

On 25 March 2026 the Scottish Ministers published a new FOI/EIR: Section 60 code of practice, which “supersedes the Section 60 Code of Practice issued by the Scottish Ministers in December 2016.” It is not law: it describes “the practice which they consider would be desirable”, and most of it says “should”. A few paragraphs say “must”. Paragraph 1.1.5: “Authorities must ensure that they have robust, proportionate systems to allow them to log, track and monitor the requests for information they receive.” Paragraph 6.2.1: “Authorities must make arrangements to allow staff to locate and retrieve information easily.” A named senior lead is good practice, not a rule: paragraph 1.2.2 says “It is good practice to have a designated, executive-level, senior member of staff with lead responsibility for FOI within each authority.”

For messaging, the paragraph that matters is paragraph 6.2.3: “Any information created or exchanged by a Scottish public authority, and which relates to that authority’s business, is held by that authority for the purposes of FOISA and the EIRs.” It goes on: “This can include paper records, informal systems such as officers’ notes, and temporary records, business-related information held on portable devices e.g. mobile phones (irrespective of whether these have been issued by the authority or are the personal property of its staff members) and non-corporate platforms, including private email accounts, text messages, mobile messaging apps (e.g. WhatsApp, Messenger, Signal etc) or any other form of personal communication. Such information is required to be located and retrieved where a request for that information has been received by the authority.” The legal footing is the Act's own test in section 3(2). On our reading, for a council that takes in school business discussed by the staff of its schools in a group chat on their own phones.

Paragraph 6.2.4 says authorities “should not be restricted to considering only the official corporate record”, and paragraph 6.2.6 asks for a record of each search: “Authorities should, wherever possible, maintain a record of searches conducted, including details of who carried out the searches and the systems that were checked.” For messages on staff's own phones, the search runs through the people who hold them, so the record shows who was asked and what they checked. FOI and personal devices covers whose devices to ask about.

Behind the search sits records management. Section 61 of FOISA provides for a separate Code of Practice on Records Management, and paragraph 6.1.1 of the Section 60 Code notes that “The Public Records (Scotland) Act 2011, places obligations on many public authorities to adopt and maintain a records management plan.”

Once a request is made, destroying the messages to stop them being disclosed is an offence. Section 65 of FOISA makes it an offence for the authority, or any person who “is employed by, is an officer of, or is subject to the direction of, the authority”, to alter, deface, block, erase, destroy or conceal a record held by the authority “with the intention of preventing the disclosure” of information the requester is entitled to. The maximum penalty is a fine at level 5 on the standard scale, which in Scotland is £5,000 under section 225(2) of the Criminal Procedure (Scotland) Act 1995.

FOISA has no offence for destroying information before any request has been made. The Freedom of Information Reform (Scotland) Bill, a Member's Bill, would have created one and would have required every authority to appoint a Freedom of Information Officer; it fell at the dissolution of Parliament on 8 April 2026, at Stage 2. It had not been reintroduced when we checked on 9 November 2026, and Katy Clark MSP, who introduced it, wrote to a Scottish Parliament committee on 24 September 2026 about “Freedom of Information (FoI) reform in the new session of Parliament”, asking about the committee's plans as useful “for my own considerations on whether to re-introduce” the Bill.

Where ComplyChat fits, and where it does not

Start with what it is not. ComplyChat does not answer FOI requests: it does not log or track them, count working days, apply exemptions or write refusal notices, and it is not a records management system. It does not reach into existing WhatsApp groups or anyone's phone. And a council-run school does not choose its own tools for council business: the council is the authority, so which systems its school staff use is the council's question, under the council's policy.

What it can help with is the gap paragraph 6.2.3 describes. Many conversations a request later reaches start outside the corporate record: a depute head and a council officer settling a pupil's placement by message, a staff group chat working out what went wrong on a trip, a leisure trust's duty managers sorting a weekend closure. On the Code's reading each is information the authority holds, and each sits on personal phones, where the FOI officer can only ask the people who hold them, and where a deleted chat may leave nothing to find.

ComplyChat is designed to keep those conversations in channels the organisation holds. Staff, and volunteers or families added by their mobile number, take part without an account on the organisation's systems, because a mobile number verified by SMS is an identity; everyone added is told the channel is on the record and can object or leave; and messages are recorded on the server as they are sent, not gathered from handsets afterwards. On paid plans, once the organisation's Microsoft 365 tenant is connected, conversations are kept within its own Microsoft 365 subscription under the retention schedules it already runs, so a request reaches a conversation the organisation already holds. Free personal messaging has three calendar months of recent history and no Microsoft 365 archive, so it cannot be an authority's record.

A question for the next senior leadership meeting: if a request arrived tomorrow for last term's messages about one decision, which systems would your search record list, and whose phones would you have to ask about?

Questions people ask

How long does a Scottish public authority have to respond to an FOI request?

Promptly, and no later than the twentieth working day after it receives the request, under section 10(1) of the Freedom of Information (Scotland) Act 2002. Weekends, Christmas Day and Scottish bank holidays do not count, and the first working day is the day after receipt; grant-aided and independent special schools may leave out days that are not school days, up to the sixtieth working day.

Does FOI apply to schools in Scotland?

Yes, but usually through the council. Councils are Scottish public authorities for all their functions, including education, so a request about a council-run school is answered by the council. Grant-aided schools and independent special schools have been covered for the running of the school since 1 September 2016; other independent schools are not covered.

How do I ask for a review of an FOI response in Scotland?

The requester writes to the authority within 40 working days, giving their name, an address for correspondence, the request and what they are unhappy with. The Commissioner advises counting from the day the response arrives (or from the end of the 20 working days if there was no reply), which is always in time; the Act counts from the end of the authority's 20 working day deadline, or from receipt of a late response, so an authority should not turn away a review made within 40 working days of its own deadline. The authority must reply within 20 working days.

How do I appeal to the Scottish Information Commissioner?

After the authority's review, the requester can apply to the Commissioner within six months of receiving the review response, or of the date it was due (section 47(4) of FOISA); the Commissioner can accept a late application. The Commissioner's appeal page says it is “taking up to nine months to allocate cases for investigation at present”. A Commissioner's decision can be appealed to the Court of Session on a point of law.

Who is the Scottish Information Commissioner?

David Hamilton, who took up post in October 2023 for a fixed term of six years, according to the Commissioner's About the Commissioner page. Under section 42 of FOISA the Commissioner is appointed by the monarch on the nomination of the Scottish Parliament.

Can I use FOI in Scotland to get my own personal information?

No. The Commissioner's Duties under FOI law page says “If someone asks an authority to give them their own personal information, this request must be responded to under data protection law, not FOI.” That is a subject access request, regulated across the UK by the Information Commission (the ICO), not by the Scottish Information Commissioner; subject access request policy covers the response.

Official guidance and your next step

The law is the Freedom of Information (Scotland) Act 2002, with the Time for Compliance Regulations 2016, the Fees for Required Disclosure Regulations 2004, the designation orders of 2013, 2016 and 2019, and, for environmental information, the Environmental Information (Scotland) Regulations 2004. The Scottish Ministers' Section 60 code of practice (published 25 March 2026) sets out the practice they consider desirable. The Scottish Information Commissioner's Who can I ask?, Asking for a review and Appeal to the Commissioner pages are written for requesters and are the clearest statement of how the regulator reads the Act. The two replies quoted in section 06 are from WhatDoTheyKnow, as captured, classified and verified for our evidence pack on 29 October 2026; other quotations are from the pages named as read on 9 and 10 November 2026.

This guide covers Scotland and is not legal advice. For maintained schools and academies in England and Wales, and schools in Northern Ireland, the UK Act applies instead: see freedom of information in schools. For a council's messaging rules, see council WhatsApp policy.

Then do one thing: open the file for the last FOI request your school, trust or service helped answer and check whether it records who searched, which systems they checked, and whether anyone was asked about messages on their own phone. If it does not, that is the first change to make.