The law gives every public body 20 working days to answer a Freedom of Information request. Miss that deadline, and the regulator you complain to can now take 35 weeks just to open your file.
Estimated reading time: 7 minutes
In short. The Freedom of Information Act 2000 gives government departments, councils, the NHS, schools and police forces 20 working days to answer a request. If they miss it, the requester's only remedy is a complaint to the Information Commissioner's Office. The ICO's own 2025/26 annual report, laid before Parliament in July 2026, records a record 10,713 FOI complaints in the year, a caseload that hit 3,505 by the end of March 2026, and a wait of 35 weeks just to get a new case allocated to an officer, up from 16 weeks a year earlier. A later update puts the active caseload higher still. The Act's real sanction, treating non-compliance as contempt of court, only arrives after that wait, after a decision notice, and after the authority ignores that notice too. Three documented mistakes: four stars.
A Freedom of Information request is one of the few legal tools that hands an ordinary person the same access to a document that a minister or a council leader has. Ask a public authority anything covered by the Act and, subject to specific exemptions, it must tell you. Public authorities include government departments, local authorities, the NHS, state schools and police forces [1]. The promise that makes that right usable rather than theoretical is a deadline. Miss the deadline, and the law's answer is a complaint to the regulator that oversees it, the Information Commissioner's Office. That regulator has just told Parliament, in its own annual report, that the queue behind that complaint is now longer than most people would wait for the original request.
The claims, tested
| The law's own words | What the record actually shows | Verdict |
|---|---|---|
| Section 10(1) of the Act: a public authority "must comply with section 1(1) promptly and in any event not later than the twentieth working day following the date of receipt" [2] | The ICO's 2025/26 annual report (HC 274, laid 14 July 2026) records 10,713 FOI complaints received in the year, "the largest number since the Act was implemented in 2005," against 7,639 the year before, a rise the ICO itself attributes partly to AI tools making it easier to escalate a complaint. Its own caseload reached 3,505 cases at 31 March 2026, more than double the 1,466 it started the year with and above even the COVID-era peak of 2,227 [3] (pages 48-49). By July 2026, a specialist regulatory news outlet reported the active caseload had reached 4,476, against 1,595 in April 2025, citing the ICO's own figures [4] | The 20-day deadline is real and specific. The mechanism a requester relies on when it is missed is a complaint queue that has grown two to three times over in about fifteen months |
| The ICO's own guidance on what happens next: "Failure to comply with a decision notice is contempt of court, punishable by a fine" [5], and section 54 lets the Commissioner "certify in writing to the court" that an authority has failed to comply with a decision notice, information notice or enforcement notice [6] | That sanction sits at the end of a chain, not the start of one. Section 50 requires the Commissioner to first receive an application, then either decide there is nothing to investigate or "serve notice of his decision (in this Act referred to as a decision notice)" [7]. Only if the authority then ignores that notice does section 54 apply at all. Every one of those steps now queues behind the same allocation wait the annual report documents: 35 weeks to reach a case officer as of March 2026, against 16 weeks a year earlier [3] (page 49) | Contempt of court is a genuine sanction on paper. Reaching the point where it could even be considered now takes most of a year longer than it used to, before the underlying non-compliance is even confirmed |
| The ICO's own account of taking the Act seriously: "Over the past three years, we've taken more enforcement action than in the entire previous lifetime of the FOI Act," 24 enforcement notices and 36 practice recommendations since 2022, eight enforcement notices in 2025/26 alone addressing backlogs affecting "almost 2,500 information requests" [3] (page 33) | Named in that same page: an enforcement notice against the London Borough of Enfield Council, which had 271 open requests over a month old, "with more possibly unlogged"; an enforcement notice against Cambridge Hospitals NHS Trust, where 67 of 222 open requests were over a year old; a practice recommendation to the Northern Ireland Ambulance Service Trust, which had "an average compliance rate of just 34% for responses within 20 working days" [3] (page 33) | Eight enforcement notices reached the worst-performing authorities the ICO had visibility of. Over ten thousand new complaints arrived in the same twelve months. The tool works on the cases it reaches; it cannot reach more than a small fraction of the queue behind it |
The mistakes, counted
The only remedy for a missed deadline now queues behind a bigger delay than the deadline itself (1). Section 10 gives a public authority 20 working days, about four calendar weeks, to respond [2]. If it does not, the Act's mechanism is a complaint to the Commissioner under section 50 [7]. The ICO's own annual report says a new case took 35 weeks to reach a case officer as of March 2026, more than double the 16 weeks it took a year before [3] (page 49). A trade outlet's more recent figure, sourced to the regulator, puts the active caseload at 4,476 by July 2026 against 1,595 fifteen months earlier [4]. A requester already kept waiting past the statutory deadline can now expect to wait many times longer again before anyone at the regulator looks at the complaint.
The Act's real sanction sits behind two more steps that carry no time limit of their own (2). Section 54 lets the Commissioner treat a breach of a decision notice, information notice or enforcement notice as contempt of court [6], and the ICO's own guidance says as much in plain terms [5]. But that power only exists once a notice has already been issued and then separately ignored. Nothing in the Act obliges the Commissioner to issue that first notice within any fixed period, and the case now has to clear the same allocation queue as everything else before it starts.
Enforcement is real and growing, but it is triage, not coverage (3). The ICO is not sitting on its hands: 24 enforcement notices and 36 practice recommendations since 2022 is, on its own account, more than the Act saw in its entire previous lifetime, and eight notices this year alone addressed backlogs covering almost 2,500 requests [3] (page 33). Set against 10,713 new complaints received in the same year [3] (page 48), eight notices is a response to the worst cases the regulator has visibility of, not a mechanism that reaches the ordinary missed deadline.
Credit where due
The ICO is using its strongest formal power more than at any point in the Act's history, not less: naming and requiring fixes from Enfield, Cambridge Hospitals NHS Trust, the Northern Ireland Ambulance Service Trust and others rather than letting poor performance go unaddressed [3] (page 33). Where the Commissioner does reach a decision, it tends to hold up: 74% of decision notices appealed to the First-tier Tribunal in 2025/26 were successfully defended, the same rate as the year before [3] (page 51), so the substance of the ICO's judgments is not the weak point, capacity is. Proactive publication, the Act's other half, is working where the ICO has pushed it: of more than 70 authorities it checked for a publication scheme, 18 lacked one, and all 18 fixed that after being asked [3] (page 32). And the ICO is not pretending the backlog is fine: it told a trade outlet directly that "our current operational performance is not what people expect," pointing to a lack of resources for the scale of the intake rather than disputing the numbers [4].
Verdict
Four stars, from three documented mistakes. Section 10 of the Freedom of Information Act still says what it has always said: a public authority answers within 20 working days, or explains why not. What has changed is the mechanism behind that promise. The regulator a requester turns to when the deadline is missed has a caseload that has grown two to three times over in little more than a year, and a wait to be assigned a case officer that itself now runs longer than the deadline that triggered the complaint in the first place. The Act's ultimate sanction, treated by the ICO's own guidance as equivalent to contempt of court, is real, but it sits behind a queue, a decision notice and a second breach before it can be used at all. None of that means the ICO has stopped acting. It means the twenty days Parliament wrote into law now depends on a safeguard that, by the regulator's own account, cannot currently keep pace with the requests the law is meant to guarantee an answer to.
Sources
- What is the FOI Act and are we covered?, Information Commissioner's Office
- Freedom of Information Act 2000, section 10, legislation.gov.uk
- Information Commissioner's Annual Report and Financial Statements 2025/26, HC 274, laid before Parliament 14 July 2026
- ICO warns over expanding backlog as complaint caseload grows threefold in a year, PublicTechnology, 21 August 2026
- FOI complaints and ICO enforcement powers, Information Commissioner's Office
- Freedom of Information Act 2000, section 54, legislation.gov.uk
- Freedom of Information Act 2000, section 50, legislation.gov.uk