Freedom of information vs. subject access requests

–– 22 Oct 2019

At Tapmydata, we believe having the full picture of what happens to your personal information is important. It feels good to find the truth about something, don’t you think? 

This truth-seeking is in many ways related to both Freedom of Information (FOIs) and Subject Access Requests (SARs); both unveil information, or data, about something or someone. 

Here, we cover the key differences between FOI and access requests and help you understand and decide which is best suited for you… 

Freedom of information request

Established in 2000 the UK’s Freedom of Information Act (FOIA) gives members of the public (you and I) the right to access recorded information held by public sector organisations. Think councils, government departments and even regulators like the FCA (Financial Conduct Authority) or the ICO (Information Commissioner’s Office).

The Freedom of Information Act covers any recorded information (data) that is held by a public authority in England, Wales and Northern Ireland, and UK-wide public authorities based in Scotland. 

Recorded information (data) can include printed documents, computer files, letters, emails, photographs, and sound or video recordings. 

This Act does not give people access to their own personal data. Anyone can make an FOI request – there are no restrictions on your age, nationality or where you live.

In a major review of the FOIA in 2016, the Independent Commission on Freedom of Information chaired by Lord Burns (the Burns Commission) said that there was a case for improving access to information about the performance and delivery of outsourced public services. These concerns became particularly relevant in the context of the Grenfell Tower tragedy in 2017.

Subject access request

The right of access, or subject access request, sometimes known as a SAR or DSAR is one of the eight rights in the European Union’s General Data Protection Regulation (GDPR). We’ve talked about this extensively. Check out the previous link for more information.

In brief, the right of access permits you to request and receive a full breakdown of all the personal data you have shared with an organisation. Think email addresses, name, date of birth, addresses, transactions. Remember this request is all about YOUR personal data. 

So what’s the difference?

The best way to know if you need to do a freedom of information or subject access request is to think about the type of information you are requesting. Always ask yourself; what information am I asking for?

If the information you want is information relating to YOU and your personal data then a subject access request will do.

If the information you want is for example about the number of car crash incidents in a given year an FOI request will do. FOIs are commonly used by the press who want to find national data to use in news articles. 

The comparison table below shows the key differences:

QuestionFreedom of Information RequestSubject Access Request
What data are you requesting?Public information, or information not related to myselfInformation that is about myself
Will it cost?In some cases yes. Particularly if the request requires a fair bit of admin.Generally no (unless the request is excessive, or unfounded)
When will I get a reply?20 calendar days from receiving the request (some cases they can extend but must state why)30 calendar days from receiving the request (in some cases they can extend but must state why)
Will I always get the information I want?Not always. Some information can be withheld for a number of reasons. Mainly to protect the government and the public. Generally, they should send you all your personal data. Companies can redact info about other citizens or refuse if the request is excessive.
Do I have to be a UK citizen to make a request?No. You can be any nationality.No. GDPR applies for all of the EU citizens, and data captured within the EU.  
What countries does the act represent?  England, Wales and Northern Ireland, and UK-wide public authorities based in Scotland. Scotland has its own version of the act. All citizens of the European Union. This includes all 44 nation-states. 
Can I complain if I’m not happy with my response?Yes. You can make a complaint to The Information Commissioner’s Office (ICO). Yes. You can make a complaint to The Information Commissioner’s Office (ICO). 

Save time & effort

Remember. Always check and think about what information you require before making an FOI or SAR request. If the data you’re requesting is about YOU, then generally a subject access request will do. 

General rule…

  • A freedom of information request is a request to gain information, not about you
  • A subject access request is a request to gain information, about you 

Understanding what information you need will save you time and effort, and means you won’t end up sending the request to the wrong people or getting the wrong information. Simples :) 

Subscribe to the Tapmydata newsletter.

    Media coverage.

    Find out who’s talking about Tap in the media.

    Download press kit

    Our partners.

    Check out our tribe of talented partners.

    Contact Tapmydata