FOI vs EIR vs Subject Access Request: Which Gets You the Data? (2026)

Three different legal rights let you demand information in the UK, and they are constantly confused: the Freedom of Information Act, the Environmental Information Regulations, and the subject access request under data protection law. They cover different information, run on different clocks, and fail in different ways. For a dissertation that depends on requested data, choosing the wrong regime wastes a month; this comparison sets out what each right covers, how they differ operationally, and which one fits the common research scenarios.

The comparison at a glance

Why the FOI/EIR boundary matters more than it looks

If the information you want is environmental — emissions, land use, planning, water quality, noise, energy, and decisions or activities affecting these — the request legally proceeds under the EIR even if you wrote “Freedom of Information request” at the top. Regulation 5 of the EIR places the duty on authorities to make environmental information available on request; authorities are supposed to reroute mislabelled requests themselves, but a well-aimed request avoids depending on that.

The operational differences cut both ways. EIR requests can be made in any form and the exceptions are generally harder for authorities to sustain, because every one of them is subject to a public-interest test; FOIA contains some absolute exemptions that are not. One statistical wrinkle researchers should know: in the Cabinet Office’s monitored statistics, “information not held” under EIR is recorded as a refusal under an exception, whereas the equivalent under FOIA is handled procedurally — so departments handling many EIR requests can look more refusal-heavy than they are. Environment, planning and infrastructure dissertations live on the EIR side of this line more often than their authors realise.

What a subject access request is actually for

A subject access request (SAR) gets you your own personal data — what an organisation holds about you, and supplementary information about how and why it is processed. You can make one verbally or in writing, organisations cannot usually charge, and they must respond within one month, extendable by up to two further months for complex requests (ICO). Unlike FOI and EIR, SARs are not limited to public authorities: they work against companies, charities and universities alike, because the right attaches to your data, not to the body’s public status.

For researchers the SAR has two honest uses and one dishonest one. Honest: understanding your own records (including, say, your own student file), and as an object of study — how organisations handle SARs is itself a researched topic. Dishonest: trying to obtain other people’s data for research. A SAR cannot do that, and a research design that quietly depends on participants SAR-ing their own records and handing them over needs specific, explicit consent architecture and ethics scrutiny — see our guide to ethics approval before building anything on that pattern.

Scenario table: which regime fits your dissertation?

How refusals differ — and why it matters for your data

The refusal machinery is where the regimes diverge most sharply in practice. Under FOIA, information is withheld under exemptions: some are absolute, while others apply only where the public interest in maintaining the exemption outweighs the public interest in disclosure. Categories students meet most often include other people’s personal data (never disclosable to the world through FOI), information intended for future publication, and commercial-interest material. Under the EIR, withholding runs through exceptions, and every one of them is subject to the public-interest test — there are no absolute carve-outs — which is one reason environmental requests are, structurally, harder to refuse. Under a SAR, the organisation must give you your data unless a specific exemption applies, the commonest being that your records are entangled with someone else’s personal data, which gets redacted rather than refused wholesale.

For research design, the practical upshot is this: a refusal is not a dead end but a datum with a stated legal ground. Log the ground cited for every refusal in your request campaign. A pattern of cost-limit refusals tells you your requests are too broad; a pattern of personal-data refusals tells you to move up an aggregation level; and the grounds themselves, tabulated across authorities, can carry a findings paragraph on institutional transparency behaviour — supported by the national base rates in the official FOI statistics.

The traps shared by all three

• None of them creates data. All three rights get you existing records. If the authority never recorded it, no regime conjures it — and “not held” responses are findings about record-keeping, not dead ends.
• All three run on real clocks with extensions. Twenty working days (FOI/EIR) and one month (SAR) are floors in practice, not ceilings — clarifications, extensions and internal reviews stretch them. Batch early, chase politely, log everything.
• Personal data is walled off from FOI/EIR. Information identifying individuals is exempt from disclosure to the world; do not design a study expecting FOI to yield person-level records. Aggregated or anonymised counts are the realistic ask.
• Escalation exists and is free. Internal review first, then the Information Commissioner’s Office — for all three regimes.

Choosing in practice

Ask two questions in order. First: whose information is it? Yours → SAR. Not yours → second question: is it environmental? Yes → EIR; no → FOI (or FOISA for Scottish public authorities). Then design the request itself with the discipline set out in our step-by-step guide to using FOI requests for dissertation data — defined fields, defined periods, the authority’s own vocabulary, spreadsheet format. And before sending anything, check whether the data already sits in a repository: the map of free datasets and open data repositories answers a surprising share of requests without a single working day on the clock.

Frequently asked questions

Do I have to say why I want the information?

No, for all three regimes. FOI and EIR are motive-blind rights available to anyone; a SAR requires only that you are (or act for) the data subject.

What happens if I use the wrong label?

Authorities are expected to handle the request under the correct regime regardless of your label — an “FOI request” for environmental information proceeds under the EIR. But knowing the regime lets you anticipate the right exceptions, clocks and formats instead of discovering them at week four.

Can I request information from a private company?

Under FOI and EIR, generally no — they bind public authorities (EIR also reaches some bodies performing public functions). A SAR, by contrast, works against any organisation holding your personal data.

Which regime is fastest?

FOI and EIR share the 20-working-day clock; SARs run on one month. In practice speed depends more on request design than on regime — tightly scoped requests come back faster under all three.

Is Scotland different?

Scottish public authorities fall under the Freedom of Information (Scotland) Act 2002 and Scottish EIRs, with their own commissioner. The rights are closely parallel; the addresses and escalation routes differ.

Can refused requests still help my dissertation?

Yes — refusals cite grounds, and the pattern of what gets withheld under which exemption is itself analysable evidence, provided you report it systematically rather than anecdotally.

Route first, request second

The regime decides the clock, the exceptions and the format rights — settle it before you draft a word. Tesify helps you plan a request-based methodology chapter and keep the evidence trail straight as responses arrive — 100% written by you.

Plan your dissertation with Tesify