Records requests, handled well.

Intake: treat every request as a request

Requests do not always say “freedom of information”. A letter, an email or a social media message asking for records may count.

• Give the public one clear address to send requests to, and tell all staff to forward anything that looks like a request there the same day.
• Record the date you received it. In most systems the clock starts on receipt, not when the right person reads it.
• Acknowledge it, with a reference number and the date a response is due.
• If the request is unclear, ask for clarification quickly. Some laws pause the clock while you wait; check yours.

Keep a log

A spreadsheet is enough. What matters is that every request is in it and someone looks at it every week.

Record, for each request:

• reference number, date received, how it arrived
• requester and how to contact them
• what was asked, in their words
• due date, and any extension with the reason
• who is searching, and where
• fees estimated and paid
• outcome: released in full, in part or refused, with the exemptions used
• date responded, and any appeal or complaint

Never use the log to judge the requester. In most systems the identity or motive of the person asking does not change their right to the information.

Deadlines vary: know yours

There is no single deadline. It depends on the law that covers your organization.

Below are the national laws we verified. Local and regional bodies usually answer to a different law from national agencies: a US town follows its state’s public records law, not federal FOIA; a New Zealand council follows a separate act from central government. Use the official source for your jurisdiction.

• United States (federal)Freedom of Information Act (FOIA)

  Federal agencies must decide within 20 working days (excluding weekends and public holidays) whether to comply.

  FOIA covers federal agencies only. State and local bodies answer to their own state’s public records law, with its own deadlines. Official source

• United KingdomFreedom of Information Act 2000

  Promptly, and no later than the 20th working day after receipt.

  Covers public authorities in England, Wales and Northern Ireland, including local authorities and parish councils. Scotland has its own Act. Official source

• Canada (federal)Access to Information Act

  Within 30 days of receiving the request, subject to extensions allowed by the Act.

  Provinces and territories have their own access laws for provincial and municipal bodies. Official source

• Australia (federal)Freedom of Information Act 1982

  Set by the Act; the OAIC publishes a processing-period calculator for agencies.

  Each state and territory has its own FOI law covering its agencies. Official source

• New ZealandOfficial Information Act 1982

  As soon as possible and no later than 20 working days after receipt, with extensions allowed in some cases.

  Local councils are covered by a separate act, the Local Government Official Information and Meetings Act. Official source

• IndiaRight to Information Act, 2005

  As fast as possible and within 30 days; within 48 hours where the information concerns a person’s life or liberty.

  Applies to public authorities at central and state level. Official source

• MexicoLey General de Transparencia y Acceso a la Información Pública (2025)

  No more than 20 days, extendable by up to 10 more with a reasoned justification.

  The 2025 law abolished INAI. The federal oversight body is now Transparencia para el Pueblo, part of the Secretaría Anticorrupción y Buen Gobierno. Official source

• ArgentinaLey 27.275 de Acceso a la Información Pública

  No more than 15 working days, extendable once by up to 15 more in exceptional cases.

  The AAIP oversees the national law. Official source

• PhilippinesExecutive Order No. 2 (2016)

  As soon as practicable and within 15 working days; extensions should not exceed 20 working days except in exceptional circumstances.

  Covers the executive branch. Local government units are encouraged, not required, to follow it. Official source

Search properly, and write down where you looked

A reasonable search is one you can describe afterwards.

• Search every place the records could be: email, shared drives, chat and messaging apps, paper files, and personal devices or accounts if work was done on them.
• Use the requester’s terms and the obvious variations: names, initials, reference numbers, dates.
• Record the places searched, the search terms and the date. If you are challenged, this is your evidence.
• Do not delete or alter records once a request has arrived. In many places that is an offence.

Review and exemptions

Release is the default. Withholding needs a reason in the law.

• Check each record against the exemptions in your law, such as personal information about other people, legal privilege, or security.
• Withhold only the part that is exempt, and release the rest.
• When you withhold anything, say which exemption you relied on and why, and tell the requester how to appeal or complain.

Redaction that actually works

Most redaction failures are not legal mistakes. They are technical ones.

The classic failures

1. Black boxes over live textDrawing a black rectangle, or highlighting text in black, hides it on screen. The words are still in the file: anyone can select, copy and paste them.
2. Text hidden in layers and commentsComments, tracked changes, speaker notes and hidden slides travel with the document unless removed.
3. Hidden rows, columns and sheetsHiding a column in a spreadsheet does not remove it. Neither does shrinking the text or colouring it white.
4. MetadataAuthor names, file paths, edit history and document properties survive most exports.
5. The text layer behind a scanA scanned page run through text recognition carries an invisible layer of text. Redacting the image leaves the text underneath.
6. Names in the wrapperFile names, email subject lines, headers and attachment names often contain the very detail you redacted from the body.

A safe method

• Work on a copy. Keep the original untouched.
• Use a true redaction tool that removes the content, not a drawing or highlighting tool. Apply the redactions, then save a new file.
• Remove hidden data. In Microsoft Office, the Document Inspector finds comments, tracked changes, hidden text and document properties.
• If in doubt, convert the redacted pages to images, so there is no text left to recover, and accept that the result is less accessible.
• Check the result: select all, copy and paste into a plain text editor, and search for the words you redacted. Then have a second person check.

Fees

Fees are set by law, not by what the work cost you.

• Under US federal FOIA, agencies can charge some requesters for search and copying, usually with no charge for the first two hours of search or the first 100 pages, and requesters can ask for a fee waiver.
• Under the UK Act, a public authority other than central government can refuse a request if complying would cost more than £450, calculated at £25 an hour (18 hours of work). Central government’s limit is £600.
• Elsewhere, check your own law. If you will charge, tell the requester in advance and offer to help them narrow the request.

Respond and track

The response is a record too.

• Send a written response that says what you are releasing, what you are withholding and under which exemption, and how to ask for a review.
• Keep a copy of exactly what was released, as released.
• Each month, look at the log: how many requests arrived, how many were late, and which subjects keep coming up. Publishing the information people keep asking for is the cheapest way to reduce requests.