The Freedom of Information Act in the UK covers a wide range of organisations. It’s believed that more than 100,000 bodies are covered by the provisions of the Act – from schools to hospitals. This means they have to receive and answer FOI requests that are sent to them.

Almost all of the bodies that are covered by the FOI Act are classified as public authorities. The Act doesn’t provide any strict definition of what a public authority is but as a rule of thumb, public authorities are organisatios that spend money collected from taxpayers. In most cases a public authority will be responsible for making, and acting upon, decisions that impact people’s lives.

Public authorities under the FOI Act include NHS organisations, councils, fire services and police forces. However, not all groups that receive taxpayers money are considered as public authorities. For instance, charities that are given grants aren’t covered by the FOI Act. Some organisations that aren’t covered by FOI laws often act in the spirit of the Act, responding to the Act as if they were covered. In these instances can’t be challenged in the same legal way as if the organisation was officially covered by the Act.

Private companies are not covered by the Freedom of Information Act. If you are looking to access information about yourself from a company, it may be possible to use a Subject Access Request (SAR) under the UK’s Data Protection Act 2018. See more on this below.

There’s no full list of public authorities that are covered by the FOI Act but the law does seek to detail the broad categories of authorities that are covered. Schedule 1 of the Act details authorities that are covered by the Act. The bodies that are covered by the Act can be altered by government ministers, but a general list of the main authorities that are covered is below.

What are public authorities under the FOI Act

The following types of bodies are considered to be public authorities under the Freedom of Information Act:

  • Government departments
  • Government agencies (such as the DVLA, or UK Border Force)
  • Councils (including parish, district, borough, county)
  • Health Authorities (all NHS bodies)
  • Fire Authorities
  • Police
  • Police and Crime Commissioner’s
  • Museums and galleries
  • Schools and academies
  • Publicly owned companies

Authorities not covered by the FOI Act 

There are unfortunately an array of publicly funded authorities that are not covered by the Act.

The main examples of these are:

  • The security services (GCHQ, MI5, MI6, etc)
  • The Queen and her Heir to the throne
  • Individual MPs or councillors
  • Housing Associations

Partly covered by the FOI Act 

Some bodies that are covered by the Act are not covered in all respects. This means that they are only covered by the Act in terms of certain information.

The BBC, for example, is not covered by the FOI Act for matters that relate to journalism, literature and art.

This area of non-coverage allows for the protection of journalistic sources and information that is used to create the BBC’s output.

Others that are partly covered by the FOI Act include:

  • The Bank of England
  • Channel Four
  • Traffic Commissioners
  • Houses of Parliament

Are private companies covered by the Freedom of Information (FOI) Act?

Private companies are not covered by the Freedom of Information Act. Broadly only organisations considered public authorities are covered by the law. This means FOI requests cannot be made to businesses and private companies generally. It is not possible to send an FOI request to a company such as McDonald’s or Thales, for instance.

If you are looking to access information about yourself from a private company, however, there is a way this can be attempted. All organisations that process personal data – information that can identify a living individual – are required to respond to Subject Access Request (SAR) under the UK’s Data Protection Act 2018. This means people can request information about themselves from organisations that hold it. There are some similarities between SAR and FOI requests.

There are some very limited instances where a private sector company may be covered by the FOI Act. Companies wholly owned by public authorities are covered by the FOI Act. For instance, where local authorities have transferred responsibility for services to a private company that they wholly own they will have to respond to FOI requests.

While the FOI Act doesn’t apply to private companies, information sent from a private company to a public authority covered by the FOI Act may be covered. This is because that information is now held by the public authority. Therefore emails sent from a private company to a public authority may be subject to disclosure under the FOI Act – this also applies to other types of information sent to public authorities from private companies.


More in this guide: 

The following pages give more information about the FOI Act and the rights of a requester.

What is the Freedom of Information (FOI) Act 2000?

What is the Freedom of Information Act (FOI) response time?

How to make an FOI request

The Freedom of Information (FOI) Act exemptions explained

How to complain about an FOI request – including to the ICO


Updated January 23, 2021: This article was originally published on January 6, 2013 and has since been updated with new information

I am a journalist and author. I am a journalist at the UK edition of WIRED magazine. In 2015, my first book Freedom of Information: A Practical Guide for UK Journalists, was published. My second book Reed Hastings: Building Netflix, was published in March 2020. I created FOI Directory in 2012 and have maintained it in my spare time ever since.