Commercial Sensitivity, Legal Privilege, and the Art of Saying No: How Boilerplate Redaction Language Shields Decisions Across UK Public Bodies

There is a particular kind of letter that arrives after a freedom of information request has been refused. It is courteous, it is footnoted, and it uses the same sentence structures regardless of which public body has sent it. Somewhere in the middle, a paragraph will explain that disclosure would prejudice commercial interests, or that the information attracts legal professional privilege, or that releasing it would not be in the public interest.

These formulations are lawful. They are also, in a great many responses, doing far more work than their authors admit. The language of refusal has become a form of institutional shorthand: a way of closing a question without engaging with it, in terms that are hard for a lay reader to argue with and rarely tested in court.

The Ferret has reviewed refusal and partial-disclosure letters issued by UK public bodies during 2026, alongside the published guidance those bodies rely on. What follows is an assessment of how the standard justifications are used, where practice diverges sharply between organisations, and what a reader can reasonably do about it.

Three phrases, most of the load

Commercial sensitivity is the most elastic. In its legitimate form, it protects pricing structures and genuinely confidential tender information. In its looser form, it protects anything a body would rather not defend in public — outsourcing costs, contract variations, performance penalties, the reasoning behind a procurement decision. The exemption requires a public interest test, but the test is often stated rather than demonstrated.

Legal privilege is the most absolute-sounding. Advice from lawyers to a public body can properly be withheld. The difficulty is boundary: factual material attached to legal advice, and the underlying reasons for a decision, are not automatically privileged. When entire files are withheld on this basis, the reasoning is rarely set out in enough detail to check.

Not in the public interest is the most rhetorical. It usually appears as the conclusion of a balancing exercise in which the factors for disclosure are listed briefly and the factors against are listed at length. Readers are invited to accept the scales were evenly held.

A fourth phrase deserves mention because it hides in plain sight: "information not held". It is sometimes true and sometimes reflects a record-keeping failure or a search that was less thorough than the request deserved.

Who leans on what

Usage is not uniform, and the differences are instructive. Central government departments tend to produce longer, more heavily lawyered refusals, with multiple exemptions cited in the alternative — a tactic that makes a successful challenge harder because a requester must defeat every ground, not one. Local authorities more often rely on cost limits and the section 12 appropriate limit, which is a volume argument rather than a substantive one. Arm's-length bodies and companies wholly owned by the public sector lean heavily on commercial sensitivity, which is unsurprising given that many of them operate in markets.

Regulators present the most revealing pattern. Bodies whose work depends on maintaining the confidence of the firms they oversee reach for commercial sensitivity early; bodies with a statutory duty to publish tend to release more and redact less. The difference appears to owe less to the sensitivity of the material than to institutional habit.

The phrase "legal privilege" clusters, in our reading, around decisions that were contentious internally. That is a reasonable inference rather than a proven finding, but it is the sort of inference a reader can test: ask for the internal correspondence about the decision, not the legal advice, and see what the response looks like.

Why boilerplate is difficult to challenge

Three structural features make standard refusal language effective.

The first is asymmetry of expertise. A requester reads the letter once. The body has a legal team, a template, and prior practice. The internal review stage — the first formal challenge — is often conducted by someone within the same team that drafted the original refusal.

The second is that exemptions are assessed at the moment of the request, not at the moment the decision was made. Documents become more sensitive-sounding with distance, not less, because the people who wrote them have moved on and the institutional instinct is caution.

The third is that the Information Commissioner's Office is slow, and everyone involved knows it. A complaint that takes many months to resolve functions, in practice, as a refusal with extra steps. Few requesters have the stamina.

None of this requires bad faith. It requires only that the default is set to withhold and the burden falls on the person asking.

A five-question transparency test

Readers who receive a refusal letter can put it through a simple check. It will not settle the legal question, but it will identify weak refusals quickly.

1. Is the harm specific? A proper refusal names the actual prejudice disclosure would cause. "Commercially sensitive" is a label; "would reveal the unit price in a live tender" is an argument.
2. Is the public interest test shown, not asserted? Look for factors on both sides. If only one side is listed, the balancing exercise has not really been performed.
3. Is the exemption applied to the right thing? Whole documents are rarely exempt in their entirety. Ask which paragraphs, and why the rest cannot be released.
4. Is there any factual material that could be separated out? Costs, dates, decisions, and outputs usually can be.
5. Would the same reasoning apply a year from now? If the answer is no, ask again later, and say so in your request.

A refusal that fails three or more of these tests is worth an internal review — and a request, in the same letter, for the public interest test documentation itself.

What a better refusal looks like

There is a version of this letter that serves everybody. It states what was withheld, in categories. It explains, in concrete terms, what harm would follow from release. It sets out the factors weighed for and against, and it says who decided. It takes perhaps two hundred more words.

Some bodies already write refusals like this. They are not obviously more secretive than their peers, and they are not noticeably slower. They have simply decided that the letter is part of the answer rather than the end of the conversation.

That choice is cultural, not legal. Which is another way of saying it is a choice ministers, boards and chief executives could make tomorrow — without new legislation, without new guidance, and without a single additional pound of public money.