Beyond the Deadline: The UK Public Bodies That Keep FOI Requesters Waiting Longest
Twenty working days. That is the statutory limit for a public authority in the UK to respond to a freedom of information request, whether under the Freedom of Information Act 2000, the Freedom of Information (Scotland) Act 2002 or the parallel environmental information regimes. It is a generous allowance by international standards, and it is honoured by most bodies most of the time.
But a persistent minority treat it as a starting gun rather than a finishing line. The Ferret has spent the autumn of 2026 combing published FOI performance logs, internal review outcomes and appeal decisions from the Information Commissioner's Office (ICO) and the Scottish Information Commissioner (SIC) to identify which parts of the public sector most often run down the clock — and what, in practice, they are withholding while they do it.
How we built the slow lane
Our analysis focused on three measures rather than one. The first is the proportion of requests answered within the statutory period. The second is the median number of working days taken when a response is late. The third, which we weighted most heavily, is the rate at which a late response is followed by an internal review that itself overruns — the clearest signal that delay is structural rather than a one-off administrative slip.
Figures are drawn from authorities' own published quarterly returns, which vary in quality and are not independently audited. Several bodies do not publish at all, a gap we address below. Where a body's figures were incomplete, we relied on appeal decision data and on the accounts of requesters who approached us.
| Rank | Type of body | Answered on time (approx.) | Median days when late | Review overrun rate |
|---|---|---|---|---|
| 1 | Large central government departments (policy and immigration functions) | 62% | 54 | High |
| 2 | Arm's-length bodies handling commercial or contractual material | 68% | 47 | High |
| 3 | Unitary councils with outsourced service delivery | 71% | 41 | Medium-high |
| 4 | NHS trusts and integrated care boards | 76% | 36 | Medium |
| 5 | Police forces (operational material) | 79% | 33 | Medium |
| 6 | Scottish Government directorates | 81% | 29 | Medium-low |
| 7 | Smaller district councils | 88% | 22 | Low |
Where the clock stops
The pattern in the table is not a story about competence. It maps closely onto two things: the volume of requests a body receives, and whether the material sought sits near money, contracts or ministerial decision-making.
Departments and arm's-length bodies dealing with procurement are the most frequent offenders. Requests for tender evaluation records, contract variations, exit payments and correspondence with suppliers are disproportionately likely to trigger what one former civil servant described to us as 'the long grass email': a forwarded query with no owner and no deadline.
Councils with heavily outsourced services show a similar profile. Where a function has been contracted out, the authority must ask the contractor for the information before it can answer. Nothing in the legislation provides an extension for that step, yet in practice it is the single most common cause of overrun we encountered.
Three requesters, three waits
A freelance journalist in West Yorkshire asked a combined authority in February 2026 for the business case behind a transport funding settlement. She received an acknowledgement the same week, a holding letter in March, a partial disclosure in June with 41 pages redacted under commercial interests, and an internal review outcome in September that upheld every redaction. She is now waiting on the ICO.
A campaigner in Glasgow requested minutes and papers relating to a decision to pause a local energy retrofit scheme. The response arrived on day 71, citing the public interest test. The internal review took a further 58 working days. The Scottish Information Commissioner has since issued a decision notice ordering disclosure of two of the four documents withheld.
A parent in south Wales asked a health board for the risk assessment underpinning the closure of a minor injuries unit. The board answered within the deadline but refused the request as vexatious. That refusal was overturned on review, and the substantive response — heavily redacted — arrived five months after the original request.
None of these are unusual. All three share a feature that recurs across our sample: the delay was not caused by the difficulty of finding the material, but by the process of deciding how much of it to withhold.
What the delays conceal
Delay is not neutral. In each of the cases above, the withheld material concerned a live public decision — a funding settlement, a paused scheme, a service closure. By the time disclosure arrives, the decision has often been taken and the window for meaningful challenge has closed.
Public authorities are entitled to withhold information where a genuine exemption applies. They are not entitled to use the passage of time as a substitute for a reasoned refusal. Yet the two are difficult to disentangle when the only visible symptom is a missed deadline.
The most common refusal categories in the late-response cases we examined were commercial interests, legal professional privilege, and the broad 'information intended for future publication' exemption — the last of which has been used in several instances to defer disclosure until after a decision was announced.
What to do when the clock runs out
If a request goes past the deadline, the first step is a written internal review request. Do not simply re-send the original query. State the date of the request, the statutory period, and ask for a review of the failure to respond as well as of any withholding.
If the review is not completed within 20 working days (40 in Scotland for some reviews), or if the outcome is unsatisfactory, a complaint to the regulator is the next step. The ICO and the SIC both accept complaints about delays as well as about refusals, and both publish decision notices that carry weight even where they are not legally binding in the first instance.
Keep a dated log of every communication. Ask for responses in writing. Where a body says it is 'considering the public interest', ask which exemption is engaged and when a substantive decision will be issued — the regulator expects a reasonable estimate.
And keep asking. The single most effective pressure on a slow authority, in our experience, is a requester who does not go away quietly.
The bodies that publish nothing
One finding deserves separate emphasis. A number of public bodies subject to the legislation do not publish any FOI performance data at all. Without that baseline, requesters cannot tell whether their experience is exceptional or routine, and regulators cannot spot patterns before complaints arrive.
The Ferret has written to four such bodies in 2026 requesting their response statistics. Two have replied. Neither has supplied the figures. We will publish the correspondence in full.
