UK FOI time limits: Section 10, the public interest extension, and ICO backlog enforcement

Every information governance team in the UK can recite the number: 20 working days. Fewer can say with confidence which day counts as day one, whether a Scottish bank holiday moves an English authority's deadline, or exactly what a fees notice does to the calculation. And until recently, the difference between knowing and guessing rarely cost anything — the Information Commissioner's Office wrote sympathetic letters about resource pressure and moved on. That era is over. Since 2023 the ICO has issued binding enforcement notices over FOI backlogs to police forces, to councils, and — in December 2025 — to a central government department. This guide sets out the statutory machinery first, then the enforcement reality.

The 20 working days: what Section 10 actually requires

Section 10(1) of the Freedom of Information Act 2000 requires a public authority to comply with a request "promptly and in any event not later than the twentieth working day following the date of receipt." That is two duties, not one. The 20 working days are a longstop; the operative word is promptly, and the ICO's time-limits guidance is explicit that the deadline is a maximum, not an allowance to be spent.

The counting rules reward precision. The date of receipt is the day the request actually arrives at the authority — and nothing in the Act requires that to be a working day, so a request that lands in a monitored inbox on a Saturday is received on the Saturday. Day one of the 20 is the first working day following the date of receipt: a request received on a Monday makes Tuesday day one; a request received on a Saturday makes Monday day one.

Section 10(6) then defines a working day as any day other than a Saturday, a Sunday, Christmas Day, Good Friday, or a day that is a bank holiday under the Banking and Financial Dealings Act 1971 in any part of the United Kingdom. That last phrase is the one that trips up deadline spreadsheets: a holiday observed only in Scotland — 2 January, most visibly — or only in Northern Ireland is a non-working day for an authority in Kent. Any calendar that simply excludes English bank holidays will quietly compute some deadlines a day early and others a day late across the year.

What pauses, restarts, or never touches the clock

Clarification restarts it

Where a request is genuinely too unclear to identify and locate the information, section 1(3) relieves the authority of the duty to comply until the further detail it reasonably requires arrives — and when the clarification comes in, the 20 working days run afresh from its receipt. This is a restart, not a pause, and it is available only for genuine clarification. Asking a requester why they want the information, or negotiating scope you already understand perfectly well, stops nothing.

A fees notice pauses it

If the authority issues a fees notice under section 9, section 10(2) directs that the working days between the day the notice is given and the day the fee is received are disregarded in the calculation. The requester has three months to pay; if payment never arrives, the duty to comply falls away. In practice fees notices are uncommon under FOIA — the chargeable items below the cost limit are narrow — but where one is issued, the paused clock is statutory, not a courtesy.

Nothing else touches it

The list of things that do not extend the deadline is longer and more painful: the volume of other requests, staff absence, third-party consultation (the section 45 Code encourages it, but it buys no time), record-holders who are slow to search, and sign-off queues in the communications office or the chief executive's office. The ICO hears all of these as explanations. It records them as breaches.

The public interest extension: elastic in name, capped in practice

Where a qualified exemption applies and the authority is still weighing the public interest, section 10(3) extends the time for that decision "until such time as is reasonable in the circumstances." Read cold, that looks open-ended. It is not, for two reasons.

First, the extension covers only the public interest balancing itself. Whether the information is held, whether the exemption is engaged, and the searching and assembly of the material must all be resolved within the ordinary 20 working days — and within those 20 days the authority must issue a notice under section 17 identifying the exemption relied on and, under section 17(2), giving an estimate of the date by which it expects to reach its decision. Absolute exemptions get no extension at all, because there is no public interest to weigh.

Second, the ICO has put a number on "reasonable": its guidance says the extension should not normally exceed a further 20 working days, giving 40 in total, and the section 45 Code of Practice frames the same figure as best practice. A longer period is conceivable in genuinely exceptional cases, but an authority relying on one should expect to justify it. Two habits are worth auditing here. Serial slipped estimates — a fresh "we expect to respond by" letter each month — feature regularly in critical ICO decision notices. And a high rate of public interest extensions across your caseload is its own signal: an authority that extends routinely is telling the regulator its triage or its records are the problem, not the balancing exercise.

Refusals have deadlines too: sections 12, 14, and 17

A refusal is a response, and section 17(5) requires a refusal relying on the cost limit or on vexatiousness to be issued within the same 20 working days. Neither ground buys time.

The cost limit in section 12 is set by the Appropriate Limit and Fees Regulations 2004: £600 for central government, Parliament, and the armed forces; £450 for all other public authorities. Time is costed at a flat £25 per hour, so the limits translate to 24 and 18 hours of work respectively — and only four activities count toward them: determining whether the information is held, locating it, retrieving it, and extracting it. Time spent redacting exempt material or weighing the public interest does not count, which is why so many estimates that feel over the limit legally are not. Similar requests from one person, or from people apparently acting in concert, received within 60 consecutive working days can be aggregated. A section 12 refusal also engages the section 16 duty to advise and assist — in practice, telling the requester how to narrow the request into scope.

Section 14 removes the duty to comply with vexatious requests. The governing authority is the Court of Appeal's decision in Dransfield [2015] EWCA Civ 454, which endorsed a holistic assessment built around four themes: the burden on the authority, the requester's motive, the value or serious purpose of the request, and any harassment or distress of staff. Burden alone can be enough — but the bar is high, and a request with genuine public value can survive even an unattractive motive. For repeated vexatious requests from the same person, section 17(6) spares the authority from issuing a fresh refusal notice each time.

Internal reviews and the Section 45 Code

FOIA itself is silent on internal reviews — no duty to offer one, no deadline to complete one. The section 45 Code of Practice (Cabinet Office, July 2018) fills the gap and is what the ICO measures against: authorities should accept a request for internal review made within 40 working days of the response, and should complete the review within 20 working days, or 40 in exceptional circumstances. "The Code isn't statutory" is technically true and practically useless — sustained failure against it is exactly the material from which practice recommendations are built.

The Code also carries the transparency expectation that feeds enforcement: authorities with more than 100 full-time-equivalent staff should publish statistics on request handling — volumes received, outcomes, and crucially the proportion answered in time — and the ICO's reporting guidance works to a quarterly cycle. Those published figures are not decoration. They are the first thing the ICO's FOI enforcement team reads about you.

EIR 2004: same headline number, different machinery

Requests for environmental information fall under the Environmental Information Regulations 2004, and the differences are more than cosmetic. Regulation 5(2) sets the same 20 working days, but the extension is a different instrument entirely: under regulation 7, an authority may formally extend to 40 working days where it reasonably believes the complexity and volume of the information make it impracticable to comply — or to decide whether to refuse — within 20, and it must notify the requester of the extension within the original 20 days. That is the only extension the EIR offer. There is no public-interest extension, even though every EIR exception carries a public interest test with an express presumption in favour of disclosure.

The EIR also have no section 12 cost ceiling — a genuinely disproportionate request is handled under the "manifestly unreasonable" exception in regulation 12(4)(b) — and an EIR request is valid however it arrives, including verbally. On review, the EIR are stricter than FOIA: regulation 11 gives the requester 40 working days to ask for reconsideration and gives the authority a statutory 40 working days to respond. The practical failure mode is misclassification: a request about flooding, planning, air quality, or contamination logged as FOI, extended under section 10(3), and answered under the wrong law — with the wrong deadline — from day one. Intake screening for environmental subject matter is a timeliness control, not just a legal nicety.

How the ICO enforces: from monitoring lists to contempt

Individual complaints produce decision notices under section 50, and a late response is a breach of section 10 the notice will record. Systemic delay is handled differently. The ICO's published FOI and Transparency regulatory manual sets out an escalation ladder — monitoring, then a practice recommendation under section 48, then a legally binding enforcement notice under section 52 — and works to a stated expectation that an authority should answer at least 90% of requests within the statutory time limits. An authority that ignores an enforcement notice can be certified to the court under section 54 and dealt with as if in contempt.

Worth being honest about the limits: the ICO cannot fine an authority for FOI lateness — there is no monetary penalty regime for section 10 breaches. What it can do is publish, direct, and escalate. Since 2022 it has shown increasing willingness to do all three, announcing action in batches several times a year and naming names:

• Croydon Council — a practice recommendation in July 2022 over its backlog of older requests, followed by an enforcement notice in June 2023 when performance did not recover.
• Greater Manchester Police — a practice recommendation in February 2023, then an enforcement notice in December 2023, by which point GMP held around 850 overdue requests, the oldest waiting almost two and a half years.
• Sussex Police and South Yorkshire Police — enforcement notices in the ICO's March 2024 action against five authorities. Sussex carried a backlog of 753 requests, 389 of them over six months old, on a recent quarterly compliance rate of 32%; South Yorkshire's rate had sat below 18% for most of the previous year — "unacceptable on any level," in the notice's words. Both forces were ordered to clear their backlogs by 31 August 2024. The same announcement delivered practice recommendations to the Department for Education, the Foreign, Commonwealth & Development Office, and the Financial Ombudsman Service.
• Liverpool City Council — an enforcement notice on 1 September 2025 requiring the backlog cleared by 8 January 2026 and the 20-day deadline met thereafter.
• The FCDO — the case that shows what happens when a practice recommendation doesn't take. After the 2024 recommendation, the department's timeliness fell from 77% in December 2024 to 65% by June 2025 and 47% by September 2025, its overdue count climbing from 32 to 174 across the year. In December 2025 the ICO issued an enforcement notice — against a central government department — requiring that by the end of June 2026 no requests on the standard 20-working-day track remain unanswered.

Around the binding notices sits a steady drumbeat of softer action: a December 2024 batch against four more authorities, a July 2025 compliance report on NHS trusts in England, and practice recommendations through late 2025 to Northern Ireland health bodies whose compliance rates had fallen to 53% and, in the ambulance service's case, 34%. The pattern across all of it is consistent: the trigger is trend data — sustained sub-90% timeliness and an ageing backlog — not any single blown deadline, and the remedy imposed is always the same pair of obligations: a published recovery plan and a hard clearance date.

What this means for your compliance calendar

The enforcement record points at a short list of operational disciplines. One authoritative clock per request, computed from the real receipt rules — UK-wide bank holidays included — paused only by fees notices and restarted only by genuine clarification. Public interest extensions logged with the exemption cited and the estimated date given, capped at a further 20 working days by policy so the ICO's cap never has to be imposed on you. Internal reviews tracked against the Code's 20-and-40 even though FOIA doesn't demand it, because the regulator does. EIR requests identified at intake, on their own extension rules and their own statutory review clock. And your quarterly statistics published and watched against the 90% expectation — because the ICO is watching the same numbers, and every authority named above got there by letting the trendline speak for itself.

Sources

• Freedom of Information Act 2000, sections 10, 12, 14, 17, 45, 48, 52, 54 — legislation.gov.uk (accessed August 2026)
• The Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004, SI 2004/3244 (accessed August 2026)
• The Environmental Information Regulations 2004, SI 2004/3391, regulations 5, 7, 11, 12 (accessed August 2026)
• Freedom of Information Code of Practice (section 45) — Cabinet Office, July 2018 (accessed August 2026)
• ICO, Time limits for compliance under the Freedom of Information Act (Section 10) (accessed August 2026)
• ICO, Time limits for compliance under the EIR (accessed August 2026)
• ICO, Requests where the cost of compliance exceeds the appropriate limit (section 12) (accessed August 2026)
• ICO, FOI and Transparency regulatory manual (accessed August 2026)
• ICO enforcement notice to Greater Manchester Police — December 2023
• ICO regulatory action against five public authorities — March 2024
• ICO enforcement notice to Liverpool City Council — September 2025
• ICO enforcement notice to the FCDO and accompanying announcement — December 2025
• ICO, FOI regulatory action index (accessed August 2026)
• Dransfield v Information Commissioner and Devon County Council [2015] EWCA Civ 454

Frequently asked questions

Running these clocks in practice

If your team is tracking section 10 deadlines, public interest extensions, EIR clocks, and internal reviews across spreadsheets, this is the workload AccessPoint was built for: our United Kingdom FOIA jurisdiction pack preloads the Act's deadline arithmetic, extensions, exemptions, and terminology, and the FOI request management capability runs intake-to-response inside your own Microsoft 365 tenant. If you're evaluating UK case-management tools, we publish plain-spoken comparisons against iCasework, eCase, and Workpro — or book a demo and see your own deadlines computed correctly, Scottish bank holidays included.

General information, not legal advice. Refer to the official text of FOIA 2000, the EIR 2004, and current ICO guidance. Last reviewed: August 2026.