“Exempt” does not mean the same thing in every regime.
SAR exemptions arise under the UK GDPR and Data Protection Act framework. FOI exemptions and EIR exceptions use different statutory tests. Always identify which access regime applies before analysing the refusal.
Ask four questions when information is withheld.
- What exact exemption or exception is being relied on?
- Does it apply to all the withheld information or only part?
- Is the test absolute, qualified, prejudice-based or subject to a public-interest balance?
- Has the organisation explained the reasoning rather than merely naming a provision?
Partial disclosure can matter.
Even where some information can lawfully be withheld, the rest may still need to be supplied. Challenge blanket refusals by separating the categories rather than assuming the whole response stands or falls together.
A useful exemption challenge is forensic, not generic.
Four questions.
1. What exact information is withheld? 2. What statutory provision applies? 3. What factual test makes it applicable here? 4. Is a public-interest test, severance/redaction or partial disclosure required?
Then use the ICO’s detailed guidance for the specific exemption/exception. “I disagree with the exemption” is much weaker than identifying the missing legal step.
SAR exemptions do not automatically justify withholding an entire document.
The right is to personal data, not necessarily to a document in its original form. An organisation may sometimes protect another person’s data while still giving you your own information. Equally, legal professional privilege or another applicable exemption can lawfully restrict access. Ask what category of information has been withheld and the legal basis, without demanding disclosure that would itself breach another person’s rights.
EIR exceptions generally require a public-interest test.
EIR contains a presumption in favour of disclosure. Most regulation 12 exceptions require the authority to balance the public interest, and exceptions are interpreted within the EIR framework. Personal data has separate treatment under regulation 13. A FOIA costs-limit analysis cannot simply be copied across to EIR; “manifestly unreasonable” has its own test.
FOI: ask whether the exemption is absolute or qualified.
| FOI concept | Why it matters |
|---|---|
| Absolute exemption | No public-interest balancing test is required for that exemption, although the scope still has to be established. |
| Qualified exemption | The exemption must be engaged and the public interest in maintaining it must outweigh the public interest in disclosure. |
| Prejudice-based exemption | The authority must establish the required likelihood and nature of prejudice, not merely cite potential embarrassment. |
| Partial exemption | Non-exempt material should still be considered for disclosure. |
“Exemption” means different things under SAR, FOI and EIR.
Do not transfer an exemption from one regime into another. Data-protection access restrictions protect interests such as third-party rights, crime/tax functions, legal privilege and certain regulatory or confidential material. FOIA has statutory exemptions in Part II. EIR uses exceptions, principally in regulations 12 and 13, with its own presumption in favour of disclosure and public-interest structure.
Official sources
Check the current source material.
ConsumerWise provides general information rather than individual legal advice. Check current rules, dates and eligibility against the official source before acting.