Skip to main content
Records Authority
Category: Laws and Regulations

Freedom of Information (FOIA)

Also known as: FOIA, Freedom of Information Act, 5 U.S.C. § 552
Simply put

Freedom of Information generally refers to the right of members of the public to request access to records held by government agencies, subject to certain exceptions that protect sensitive information. In the United States, this right is established by the Freedom of Information Act (FOIA), a federal statute intended to support an informed citizenry and government accountability. The specific scope, procedures, and exemptions vary by jurisdiction, so comparable access rights in other countries operate under their own laws and terminology.

Formal definition

In the U.S. federal context, the Freedom of Information Act (FOIA), codified at 5 U.S.C. § 552, is a statute that allows any person to request access to records held by federal agencies unless those records fall within one of the Act's protected categories of exemptions. As described in a Congressional Research Service legal overview, FOIA establishes a multi-part system requiring federal agencies to disclose a broad range of government records, subject to defined limits. The Act was subsequently amended, including by the FOIA Improvement Act. FOIA requests are commonly handled alongside, but remain distinct from, requests made under the Privacy Act, and some agencies have moved to online submission of such requests. The scope described here is specific to the U.S. federal regime; freedom of information obligations differ across jurisdictions, sectors, and levels of government, and equivalent regimes elsewhere are governed by separate legislation. Freedom of information governs access and disclosure of existing records rather than the retention, classification, or disposition of those records, which fall within the broader domain of records management and information governance.

Why it matters

Freedom of Information regimes serve as a primary mechanism through which the public can hold government to account and remain informed about the activities of public bodies. In the United States, the stated function of the Freedom of Information Act is to support an informed citizenry, which is regarded as vital to the functioning of a democratic society. For records professionals, this means that records created and held by government agencies may be subject to disclosure obligations that exist independently of, and sometimes in tension with, internal handling practices.

Because access rights attach to existing records, the ability of an agency to respond to a request depends heavily on how well those records have been managed, located, and preserved over time. Poor recordkeeping can impair an agency's capacity to identify responsive records or to apply exemptions appropriately, while well-governed records support timely and defensible responses. It is important to note that freedom of information governs access and disclosure of records that already exist; it does not itself dictate how long records are kept, how they are classified, or when they are disposed of, which fall within the broader domain of records management and information governance.

The specific scope, procedures, and exemptions of freedom of information vary considerably by jurisdiction, sector, and level of government. The U.S. federal regime under FOIA is only one example, and comparable access rights in other countries operate under their own laws and terminology. Professionals should therefore treat the applicable legal framework, rather than any single national model, as the controlling authority in a given context.

Who it's relevant to

Records managers in government agencies
Records managers supporting public bodies are central to an agency's ability to respond to access requests, since a request can only be satisfied against records that have been captured, retained, and can be located. While freedom of information does not itself govern retention or disposition, sound records management practices directly affect whether an agency can identify responsive records and respond in a timely and defensible manner.
FOIA and access-to-information officers
Officers who administer access requests must determine whether requested records exist, apply the applicable exemptions, and manage the interaction between freedom of information and related regimes such as, in the U.S. federal context, the Privacy Act. Their work depends on the specific procedures and exemptions established under the governing legislation in their jurisdiction.
Compliance and legal teams
Compliance leads and legal advisers help interpret the scope of disclosure obligations and exemptions, which vary by jurisdiction, sector, and level of government. They should treat the applicable statute rather than any single national model as controlling, and should be aware that access obligations operate distinctly from retention, classification, and disposition requirements.
Information governance leaders
Those responsible for the broader accountability framework spanning policy, risk, and privacy should recognize that freedom of information intersects with, but is distinct from, records management. Effective information governance positions an organization to meet access and disclosure obligations while also managing the retention and protection of the underlying records.

Inside FOIA

Right of access
A statutory mechanism, present in many jurisdictions, that entitles individuals or organizations to request access to information held by public authorities, subject to defined exemptions and procedures. The precise scope of who may request, what bodies are covered, and what information is reachable depends on the applicable national or sub-national regime.
Covered bodies
The public authorities or organizations subject to freedom of information obligations. Coverage typically extends to government departments and public sector bodies, but the exact list and whether private entities performing public functions are included varies by jurisdiction and sector.
Exemptions and exclusions
Categories of information that may be withheld, either absolutely or subject to a public interest test, depending on the regime. Common areas addressed include personal data, national security, commercial confidentiality, and legal privilege, though the specific grounds and their application differ across jurisdictions.
Request handling process
The procedural framework for receiving, logging, clarifying, and responding to requests, often within a defined statutory timeframe. The applicable deadlines, fee arrangements, and formal response requirements depend on the governing legislation.
Relationship to recordkeeping
Freedom of information depends on the ability to locate, retrieve, and produce records that are authentic, reliable, and usable. Sound records management, including classification and retention practices, underpins an organization's capacity to respond to requests, though freedom of information itself is a disclosure regime rather than a records management discipline.
Review and appeal routes
Mechanisms by which a requester may challenge a response, refusal, or handling decision, often through internal review followed by an external regulator or tribunal. The availability and structure of these routes are determined by the relevant jurisdiction.

Common questions

Answers to the questions practitioners most commonly ask about FOIA.

Does a freedom of information request give someone the right to access any record an organization holds?
No. Freedom of information regimes typically grant a qualified right of access to recorded information held by covered public bodies, not an unconditional right to everything. Most regimes include exemptions or exclusions, often covering areas such as personal data, commercially sensitive information, matters of national security, or legal privilege, and the specific scope, exemptions, and bodies covered depend on the jurisdiction and applicable legislation. Access is therefore best understood as presumptive but subject to defined limits rather than absolute.
Is freedom of information the same thing as data protection or privacy access rights?
They are related but distinct. Freedom of information generally concerns access to information held by public bodies about their activities and decisions, whereas privacy and data protection regimes typically govern how personal information is handled and often provide individuals a separate right to access their own personal data. The two can intersect, for example, where a request seeks records containing personal information about others, and the balance between them depends on the relevant jurisdiction and its legal framework. Practitioners should treat them as separate obligations that may need to be reconciled rather than as interchangeable.
How does an organization determine whether a document falls within the scope of a freedom of information request?
Scoping generally involves identifying whether the organization is a body covered by the applicable legislation, whether the requested material constitutes recorded information held by that body, and whether any exemptions or exclusions may apply. Because coverage and definitions vary by jurisdiction and sector, organizations often rely on documented procedures and, where needed, legal or information governance advice to make defensible scoping determinations.
What role do records management practices play in supporting freedom of information responses?
Sound records management typically underpins the ability to respond to access requests, because well-classified, retained, and retrievable records make it easier to locate responsive material within applicable timeframes. Consistent capture, classification, and retention practices, along with reliable search and retrieval, help organizations demonstrate that they have conducted a reasonable and defensible search. The specifics of what is required depend on organizational policy and the relevant legal framework.
How should an organization handle a freedom of information request that overlaps with records subject to a legal hold or retention obligation?
Where requested records are subject to a legal hold or a retention obligation, organizations generally need to reconcile competing requirements: material under a legal hold typically should not be destroyed even where routine disposition would otherwise apply, while access obligations may still require considering the material for release subject to any exemptions. Because both access rights and hold or retention requirements vary by jurisdiction and sector, coordination between records management, legal, and information governance functions is commonly advisable to avoid inadvertent destruction or improper disclosure.
What documentation should an organization maintain about how it processes freedom of information requests?
Organizations often maintain records of the request, the search conducted, decisions on scope and any exemptions applied, and the response provided, so that their handling can be shown to be reasonable and consistent with policy. Such documentation can support accountability, internal review, and any appeal or oversight processes that may exist under the applicable regime. The precise documentation expected depends on organizational policy and the relevant jurisdiction's requirements.

Common misconceptions

Freedom of information gives an unrestricted right to see any information a public body holds.
Access rights are typically subject to exemptions, exclusions, and, in many regimes, public interest balancing. Whether particular information must be disclosed depends on the applicable legislation and the specific circumstances, so the right is qualified rather than absolute.
Freedom of information and records management are the same activity.
They are distinct but interdependent. Records management concerns the control of records as evidence across their lifecycle, while freedom of information is a disclosure regime governing access to information held by covered bodies. Good records management supports the ability to respond to requests, but the two serve different purposes.
Freedom of information obligations are the same everywhere.
Freedom of information regimes vary significantly across jurisdictions and sectors in terms of covered bodies, exemptions, timeframes, fees, and appeal routes. Requirements should be assessed against the specific national or sub-national law that applies.

Best practices

Maintain sound records management practices, including reliable classification and retention, so that records subject to potential requests can be located, retrieved, and produced in an authentic and usable form.
Establish a documented request handling process that logs requests, tracks applicable deadlines, and ensures responses are prepared within the timeframe required by the relevant jurisdiction.
Confirm which bodies and information fall within the applicable freedom of information regime, recognizing that coverage and scope depend on the governing legislation and sector.
Apply exemptions and any public interest considerations carefully and consistently, documenting the reasoning for withholding information so decisions are defensible.
Coordinate freedom of information handling with privacy and data protection functions, since requests may involve personal data whose disclosure is governed by separate, jurisdiction-dependent obligations.
Ensure staff understand the available review and appeal routes and handle challenges in line with the procedures set out under the applicable law.