An ICO enforcement notice gives King's College London until January to hit 90 per cent on-time compliance with Freedom of Information requests. Its own plan doesn't settle how it sustains that rate until three months later.
Estimated reading time: 6 minutes
In short. The Information Commissioner issued King's College London (KCL) with a Freedom of Information Enforcement Notice on 10 July 2026, after compliance with the 20-working-day statutory deadline fell to 58 per cent across 2025/26 and 21 per cent in the worst quarter (page 4) [1]. Annex 1 sets a backlog-clearance deadline of 29 January 2027, the same date by which KCL must also prove it hit 90 per cent on-time compliance for October to December 2026, a quarter that started this month (page 10) [1]. KCL's own published recovery plan does not expect to review the structure meant to sustain that figure until April 2027 (page 5) [2]. Four documented mistakes: three stars.
Freedom of Information requests to a public authority are supposed to get an answer within 20 working days. At King's College London, during the final quarter of the 2025/26 academic year, only 21 per cent did (page 4) [1]. The Enforcement Notice that followed does something this site's reporting on two sibling ICO cases this week, Derby City Council and Northamptonshire Fire and Rescue Service, did not find: it gives a public authority a specific percentage to hit, on a specific set of dates, and the clock on that percentage started running on 1 October.
A compliance rate that collapsed in one quarter
The Commissioner's figures are KCL's own, supplied during a compliance review that began after KCL "proactively informed the ICO" on 23 April 2026 that it was struggling, citing "unprecedented volumes" of requests and "substantial staff turnover" in its information rights team (page 3) [1]. The notice records that KCL completed 789 requests under FOIA and the Environmental Information Regulations during 2025/26, evidence of a genuinely heavy caseload, but that it still had 126 requests open as at 31 March 2026 (page 4) [1]. How many of those were overdue depends on which paragraph is read: paragraph 15 puts it at 76 (page 4), paragraph 20 puts it at 75 (page 6), both stated for the identical date in the same ten-page notice [1].
A backlog that grew after King's said it would slow down
Whichever figure is correct, what happened next is clear. By 1 June 2026, five weeks after KCL's own disclosure to the regulator, overdue requests had risen to 127 out of 172 open, around 74 per cent of everything on the books (page 6) [1]. That is a rise of roughly 70 per cent in about nine weeks, during the exact window KCL says it was already recruiting replacement staff and restructuring its team (page 5) [1]. The Commissioner credits KCL with engaging "constructively" throughout (page 6) [1]; the numbers KCL supplied him show the problem getting worse, not better, in the months before the Notice was served.
The one number the regulator did set
Annex 1 requires KCL to clear its backlog of outstanding requests and achieve "an average 'in time' compliance rate for requests of 90%" for the three months from 1 October to 31 December 2026, both confirmed by 29 January 2027 (page 10) [1]. Among this week's three ICO Freedom of Information Enforcement Notices this site has examined, that makes KCL's case distinctive. Derby City Council and Northamptonshire Fire and Rescue Service were each given a backlog-clearance deadline with no ongoing compliance-rate target attached to what comes after. Nottingham University Hospitals NHS Trust's notice does set a 90 per cent target, but its deadline for proving it runs to 1 June 2028, nearly two years out. KCL's test quarter is running now, and the regulator will know by the end of January whether it was met.
A plan whose own clock runs past the deadline
KCL published its required action plan on 14 August 2026, three days ahead of its 17 August deadline, and its executive summary states plainly that "the University accepts the findings of the Enforcement Notice" [2]. Its Phase 1 timetable runs four new staff into post by September 2026, but schedules a review of the Information Compliance Team's own case-handling process, and of the templates staff use to answer requests, for October 2026, and refresher training plus a republished FOI policy for December 2026, the final month of the quarter the Commissioner is measuring (page 4) [2]. The move to a new case-management system is not due until January 2027, after the quarter has already closed (page 4) [2]. Phase 2 of the plan, due by April 2027, is where KCL itself schedules a review of the "long term structure and resourcing model for the Information Compliance Team", with success measured as a "sustainable model for delivery of the team's functions including ongoing compliance with 90% on time target identified" (page 5) [2]. That review lands three months after the ICO's own 29 January 2027 deadline for KCL to have already hit the figure once.
What the public can check, and when
KCL's Freedom of Information page tells visitors that "King's is committed to openness, and we proactively publish a lot of information about the University and its activities on our website" [4]. The action plan's own monitoring mechanism for this Notice is an internal one: "implement monthly FOI stats and report progress against this plan to the University Secretary", due from August 2026 (page 4) [2]. Nothing on KCL's public FOI page, as of this piece going live, publishes any of those monthly figures. Whether the test quarter now under way is on track for 90 per cent is not something a student, journalist or watchdog can check before the January deadline arrives; it is reported upward, not outward.
The claims, tested
| The document's own words | What the record shows | Verdict |
|---|---|---|
| KCL "reported 126 open requests as at 31 March 2026, of which 76 were overdue" (page 4) [1] | The same notice later states "as of 31 March 2026, KCL reported 75 overdue requests" (page 6) [1] | The regulator's own notice gives two different overdue-request counts for the same date, never reconciled |
| KCL "proactively informed the ICO" of delays on 23 April 2026 and described recruitment and restructuring already under way (page 3, page 5) [1] | Overdue requests rose from 75-76 on 31 March to 127 by 1 June, roughly a 70 per cent increase in the nine weeks after that disclosure (page 6) [1] | Whatever KCL had begun by late April had not arrested the backlog's growth two months later |
| Annex 1 requires 90 per cent on-time compliance for October to December 2026, confirmed by 29 January 2027 (page 10) [1] | KCL's own plan schedules the review of the structure meant to sustain that figure, including the 90 per cent target itself, for April 2027 (page 5) [2] | The infrastructure the university's own plan treats as necessary is not due for review until three months after the regulator's deadline for having already hit the number once |
| KCL states it is "committed to openness" and proactively publishes information about its activities [4] | The plan's only progress check is a monthly report "to the University Secretary" (page 4) [2], with no compliance figures published anywhere on the public FOI page | The one set of numbers that would let the public watch the clock is reported internally only |
Credit where due
KCL did not contest the Commissioner's findings, told the ICO about its own problems before being caught, and published its action plan ahead of schedule. The plan itself is specific: named owners, dated milestones, and a structure that runs well beyond the minimum the Notice required, into 2027. A university that is short-staffed and over-requested is not the same as one that is hiding the fact.
Verdict
Three stars, from four documented mistakes. This is the first Freedom of Information Enforcement Notice examined on this site where the regulator set a dated, numeric compliance target with the test window already running rather than years away. That makes it a genuinely harder case for King's College London than the backlog-only notices served on Derby and Northamptonshire, and KCL's own paperwork shows it knows that. What the paperwork does not show is a plan built to be ready in time: the process reviews, the training and the published policy that would actually drive an October-to-December compliance rate are scheduled into the quarter itself, and the review of whether the whole structure is sustainable comes after the regulator has already checked the number once.
The star score counts four documented mistakes: the Enforcement Notice itself records two different overdue-request counts, 76 and 75, for the identical date of 31 March 2026; the backlog grew by roughly 70 per cent in the nine weeks after KCL's own proactive disclosure to the regulator, despite recruitment and restructuring already said to be under way; KCL's own action plan schedules the process, template and training fixes meant to drive the measured quarter's compliance rate into October to December 2026 itself, and defers review of the long-term structure behind the 90 per cent target to April 2027, three months after the regulator's own 29 January 2027 deadline for having already hit it; and the only progress reporting the plan commits to is internal, to the University Secretary, leaving the public with no way to check progress before that deadline arrives. Four falls in the 4 to 9 band: three stars; the bands are on the ratings page. This piece makes no finding that King's College London will miss the 90 per cent target, which it may yet hit, or that its action plan is not genuine; the finding is narrower, that the regulator's own notice contains an unreconciled figure and that the university's own published timetable does not treat the infrastructure behind its hardest deadline as settled until after that deadline has passed. Checked directly against the ten-page Enforcement Notice PDF (full text) and KCL's own six-page FOI Improvement Action Plan (full text), both fetched 5 October 2026.
Sources
- King's College London: Enforcement Notice (PDF), Information Commissioner's Office, dated 10 July 2026
- FOI Improvement Action Plan (PDF), King's College London, published 14 August 2026
- King's College London, Information Commissioner's Office, FOI regulatory action page
- Freedom of Information, King's College London