FOI vs Subject Access Request Difference UK: FOI vs SAR vs Complaint Explained

When something goes wrong with a school, council, landlord or public authority, many people search for the FOI vs subject access request difference UK because they are unsure which route to take.

Some people submit a Freedom of Information request when they actually need a Subject Access Request. Others send complaints when the information they need should have been requested first. Choosing the wrong route can delay answers by weeks or even months.

Understanding the difference between an FOI request, a Subject Access Request and a formal complaint helps you get the right information and move the issue forward faster. This guide explains when to use each option, how they differ legally, how each is processed internally, and how to decide which route fits your situation.

What Is the Difference Between an FOI and a Subject Access Request in the UK?

The key difference is straightforward once you see it clearly. Each process exists for a distinct purpose and is governed by separate legislation.

A Freedom of Information request asks for general information held by a public authority. It is not about you personally. It is about what the organisation knows, does or has decided as a matter of public record.

A Subject Access Request asks for information that an organisation holds about you or your child specifically. It is personal data, and your right to it comes from data protection law rather than freedom of information law.

A formal complaint is used when you believe something has been done incorrectly and you want the organisation to investigate, acknowledge or correct it. A complaint is not a request for information. It is a request for action.

The three processes exist for different reasons, are handled by different teams and trigger different legal obligations. Confusing them often causes significant delays.

When Should You Use a Freedom of Information Request?

A Freedom of Information request is used when you want general information held by a public authority, not personal data. The law behind FOI requests is the Freedom of Information Act 2000, which allows people to ask for recorded information from public bodies such as councils, schools and government departments. The Information Commissioner’s Office provides full FOI guidance on what qualifies, how to submit and what exemptions apply.

Typical examples of information you can request under FOI include policies and internal procedures, statistics and performance data, contracts held by the authority, guidance used by decision-makers, and meeting minutes or reports relating to public decisions.

For example, a parent dealing with an EHCP dispute might submit an FOI request to ask how many EHCP assessments the council completed last year, what internal policy the council follows when reviewing annual reviews, or what training staff receive on SEND decision-making. These are questions about the organisation's general practice, not about a specific individual's case.

Because FOI requests relate to public information rather than personal data, anyone can submit them and anyone can see the responses. Public authorities are required to respond within 20 working days under the FOI Act, though exemptions exist for information that is commercially sensitive, relates to ongoing investigations or falls outside the scope of the Act.

When Should You Use a Subject Access Request?

A Subject Access Request is used when you want personal information held about you or your child. SAR rights come from the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The Information Commissioner’s Office explains SAR rights in full, including what organisations must provide and within what timeframe.

You might submit a SAR if you want access to emails in which you or your child are mentioned, case notes held by a council or school, internal communications about a complaint you have raised, reports used in decision-making about your case, or assessments and records held by a health or education authority.

For example, if a local authority has refused an EHCP assessment, a SAR could reveal the internal emails and case notes discussing that decision. Those internal discussions are personal data relating to your specific case. They are not accessible through an FOI request, which can only return general information and not personal records.

Organisations must respond to a Subject Access Request within one calendar month in most cases, with a possible extension to three months for complex requests. If an organisation fails to respond, you can report this to the Information Commissioner’s Office, which has powers to enforce compliance.

When Should You Make a Formal Complaint Instead?

A complaint is used when you believe an organisation has failed to follow its policy, delivered poor service, made an incorrect decision or ignored an earlier request. Complaints trigger investigation and review rather than information disclosure. For councils, unresolved complaints may eventually be reviewed by the Local Government and Social Care Ombudsman. NHS complaints that cannot be resolved internally can be escalated to the Parliamentary and Health Service Ombudsman.

A complaint might be appropriate when EHCP provision is not being delivered as specified in Section F, repairs promised by a council landlord have not been completed, a school has failed to follow its own complaints process, or a public authority has delayed responding to requests beyond its stated timescales.

If you are unsure which type of issue you are dealing with, the scenarios explained on the LetterLab areas we help with page show how different disputes are typically approached and which route is usually most effective.

Decision Tree: FOI vs SAR vs Complaint

Use this step by step structure to identify the correct route before you write anything.

STEP 1: Are you asking for information specifically about yourself or your child?

→  YES — Submit a Subject Access Request (SAR)

→  NO  — Continue to Step 2

STEP 2: Are you asking for general information, policies, statistics or procedures held by a public body?

→  YES — Submit a Freedom of Information (FOI) request

→  NO  — Continue to Step 3

STEP 3: Are you asking the organisation to investigate, acknowledge or correct something that went wrong?

→  YES — Submit a formal complaint

STEP 4: Do you need evidence before you can challenge a decision effectively?

→  YES — Submit a SAR first to gather the evidence, then a complaint once you have reviewed it

This simple structure prevents the most common mistake: sending the wrong type of request first and losing weeks while the organisation redirects you to a different process.

Worked Example: A Parent Challenging an EHCP Decision

Imagine a parent believes a council has wrongly refused an EHCP assessment. Their first instinct is to submit an FOI request asking why the decision was made. The council replies with general policy documents but not the specific reasoning behind the individual case. The parent still does not know what actually happened.

A more effective sequence works like this. First, submit a Subject Access Request asking for all emails, case notes and reports relating to the EHCP assessment decision. This often reveals the internal discussions and considerations that led to the refusal. Second, once the SAR response is received, review the internal documents carefully. If the decision appears inconsistent with the evidence or with the council's own stated criteria, use what you have found to inform a formal complaint.

The SAR provides the evidence. The complaint challenges the decision. The FOI, in this situation, was the wrong starting point entirely. Beginning with a SAR saved the parent from weeks of delay.

Why Choosing the Correct Route Matters

Each process has different legal response timescales and is handled by entirely different teams within an organisation. FOI requests are routed to information governance teams. Subject Access Requests are processed by data protection officers. Complaints are reviewed by complaints investigators or service managers.

If your correspondence mixes all three approaches in a single letter, the organisation must decide which process applies. That internal routing decision alone can add weeks to the response time. A letter that clearly signals from the first sentence which type of request it is gets directed to the right team immediately.

FOI requests normally receive responses within 20 working days. Subject Access Requests must usually be answered within one calendar month. Complaints follow internal investigation timelines which vary between organisations but are typically governed by the organisation’s published complaints policy. If any response deadline is missed, you can report non-compliance to the Information Commissioner’s Office for FOI and SAR breaches, or escalate through the relevant ombudsman route for unresolved complaints.

Decision-Maker Perspective: How Requests Are Processed Internally

Understanding how organisations handle these requests from the inside helps you write more effective correspondence.

When an FOI request arrives, it is logged by the information governance or legal team. The team then identifies which department holds the relevant information and whether any exemptions apply. The response is typically reviewed before sending to ensure it does not release information that should be withheld.

When a Subject Access Request arrives, the data protection officer or their team takes responsibility. They must identify all systems, databases and communication records that might contain your personal data. For larger organisations this can be extensive, which is why the response window is one month rather than 20 working days.

When a formal complaint arrives, it is usually passed to a complaints manager or the relevant service head. The investigation involves reviewing internal records, speaking to staff involved and producing a formal written response. If the complaint involves legal risk or potential ombudsman referral, it may also be reviewed by the legal team before the response is sent.

Knowing this, a clear first paragraph that states exactly what type of request you are making removes any ambiguity about where your letter should go. Ambiguous correspondence gets delayed at the routing stage.

Self-Check: Which Route Do You Actually Need?

Before writing your letter or email, run through these five questions.

1. Am I asking for information about myself or my child specifically? If yes, you need a Subject Access Request.

2. Am I asking for policies, statistics or general documents held by a public body? If yes, a Freedom of Information request is appropriate.

3. Am I asking the organisation to investigate or correct something? If yes, you need a formal complaint.

4. Do I need information before I can challenge a decision effectively? If yes, submit a SAR first to gather evidence, then use it to support a complaint.

5. Would a decision-maker reading the first sentence immediately understand what type of request this is? If the purpose is unclear, the request risks being misclassified and delayed.

Getting the opening sentence right is often the difference between a request being handled promptly and one being redirected. If you want help ensuring your letter clearly signals the correct route from the first line, the team at LetterLab can review and strengthen the opening before you send it.

Common Mistakes That Slow Down the Process

Submitting an FOI when you need a SAR. FOI only returns general information. If you need to know what was said about your specific case, only a SAR will give you that. An FOI response to a question about your own case will typically confirm that the information is exempt under data protection provisions.

Submitting a SAR when you actually want to complain. A SAR gives you documents. It does not trigger any investigation or require the organisation to correct anything. If something has gone wrong, a SAR can provide supporting evidence, but the complaint itself needs to be submitted separately.

Mixing all three in one letter. Writing a letter that simultaneously asks for information, requests personal data and raises a complaint is one of the most common causes of delayed responses. Each process should be submitted separately, and in the right order.

Complaining before gathering evidence. A complaint submitted without the evidence to support it is far harder to pursue. In many cases, a Subject Access Request first gives you exactly what you need to make the complaint specific and evidenced.

Not following up when deadlines are missed. Both FOI and SAR have legal response deadlines. If the deadline passes without a response, do not assume the request has been lost. Follow up in writing, referencing the original submission date and the statutory deadline. If the organisation still does not respond, report the failure to the Information Commissioner’s Office.

The Key Takeaway: Route First, Then Write

Understanding the FOI vs subject access request difference in the UK helps you choose the right route when dealing with public authorities, schools, councils and other organisations.

Freedom of Information requests are used for general information held by public bodies. Subject Access Requests give you access to personal data about yourself or your child. Complaints trigger investigation and require the organisation to respond to what has gone wrong.

Choosing the correct process at the start prevents delays caused by misdirected requests. Submitting in the right order, SAR first where evidence is needed before a complaint, gives you a stronger position when you do escalate.

When the route is clear and the letter is structured correctly from the first sentence, organisations can act on it far more quickly. That clarity is worth getting right before anything is sent.