An FOI internal review asks the public authority to reconsider how it handled your request, including searches, exemptions, delay and refusal reasoning.
FOIA itself does not create the same express mandatory internal-review mechanism as the EIR, but the FOI Code of Practice and ICO process expect authorities to have a complaint/review procedure. In practice, an internal review is usually the step before an ICO complaint.
A useful internal review is not a repeat of the original request. It identifies what is wrong with the response and what reconsideration you want.
Key points
- Quote the request and refusal reference.
- Challenge specific exemption elements or search issues.
- Raise delay/procedural defects separately from actual refusal grounds.
- Ask for fresh consideration by someone appropriately independent of the original handling where possible.
Challenge the response
An internal review should identify what you say was wrong.
Separate delay, inadequate searches, refusal reasoning, exemption application and public-interest reasoning. Ask the authority to review those specific points rather than simply saying you remain dissatisfied.
Use the refusal route for a regime-aware checklist.
Good grounds for review
- The authority says information is not held but likely systems were not searched.
- The exemption does not fit the information.
- The public-interest balance is generic or incomplete.
- Too much information was redacted.
- The response failed to address part of the request.
What to attach
Attach the request, response/refusal and only the key contextual evidence. The reviewing officer should be able to understand each ground without reconstructing months of correspondence.
After review
If you remain dissatisfied, the ICO complaint should include the internal-review request and outcome. Current ICO public guidance asks FOI complainants to use this route where appropriate.
In practice
- Treat the review as an appeal document: ground, reason, requested correction.
- Keep original and review decisions side by side; new reasons can matter.
- Do not miss the ICO complaint timing while chasing repeated informal reconsideration.
What to do
A practical next-step plan
- Identify each defect in the initial response.
- Write numbered review grounds.
- Ask for the outcome and any revised disclosure.
- Keep the review decision.
- Refer to ICO if unresolved.
Common traps
Things that often confuse the issue
- Simply writing “I disagree”.
- Adding a significantly new FOI request inside the review instead of challenging the original handling.
- Assuming the review will automatically cure an overdue case without follow-up.
Evidence worth keeping
After the review, the ICO can investigate.
ICO public guidance normally expects you to complete the authority’s internal review first. If the review remains unsatisfactory, submit the request, original response, review request and review outcome together, with a short explanation of the live issues.
Keep the ICO complaint narrow.
“Issue 1: section X remains disputed because… Issue 2: I do not consider the searches adequate because… Issue 3: the review did not address…”
You can challenge “information not held” as well as redaction.
If you believe further information is held, explain why: a policy refers to a report, an email chain has missing attachments, a system normally produces an audit record, or another disclosure shows a document existed. Avoid asserting that records “must exist” without a factual basis. Ask what searches were performed and which locations/systems were checked where appropriate.
Ask promptly and identify the issues.
ICO guidance says review requests should be made within 40 working days of the initial response where the authority operates that procedure. Reviews should usually be completed within 20 working days and no more than a further 20 working days in exceptional circumstances, absent legitimate reasons for longer.
- State the original request/reference.
- Identify each disputed part of the response.
- Explain why the exemption/search/interpretation is challenged.
- Ask for any newly disclosable material with the review outcome.
- Keep the review request and acknowledgement.
An internal review should be a fresh look, not a defence of the first answer.
FOIA does not itself create the same statutory review mechanism as EIR, but the section 45 Code and ICO guidance treat a proper internal review as good practice. It should reconsider handling and outcome, preferably by someone not involved in the first decision, and can correct the search, interpretation, exemptions or public-interest analysis.
Official sources
Check the rules behind this guide
These are official or primary sources for this topic. Rules, scheme terms and deadlines can change, so check the live source before relying on a formal time limit or procedure.