A refusal is rarely the end. The two-step challenge — internal review then ICO — is free and frequently overturns weak refusals or forces a proper response.
What is it?
An internal review is a fresh look by the authority (ideally someone not involved before). An ICO complaint asks the regulator to decide whether the authority handled your request lawfully, and the ICO can order disclosure.
Who needs it & when
Anyone whose FOI/EIR request was refused, partly answered, met with an exemption they dispute, or simply ignored beyond 20 working days.
Deadlines & key rules
- Ask for an internal review promptly — the ICO expects it within about 40 working days / 2 months.
- The authority should complete the review within a reasonable time (usually 20–40 working days).
- Only after the internal review (or undue delay) should you complain to the ICO.
- The ICO can issue a Decision Notice ordering disclosure.
How to do it — step by step
- Request an internal review, identifying the request, the response, and exactly why it’s wrong (challenge the exemption / public-interest balance).
- Await the outcome; keep the correspondence.
- If still unsatisfied, submit a complaint to the ICO with the full timeline and documents.
How Chris helps
Tell Chris what was refused and why it’s wrong, and Chris drafts your internal-review request and ICO complaint to a high, professional standard — you check, sign and send. Not a law firm.
See it done — an FOI internal-review request, drafted in minutes
A request for an internal review after an FOI refusal, drafted to a high, professional standard — Chris builds it from your facts in minutes. Scroll the sample below.
Illustrative sample with fictional names and details. Chris drafts yours from your own facts; you check, sign and submit.