Document control
| Version | Date | Author | Status | Change |
|---|---|---|---|---|
| 0.1 | Monday 3 August 2026 | Business analyst | Draft | First draft |
| 1.0 | Monday 17 August 2026 | Business analyst | Approved | Approved by the information governance lead (STK-06) |
| 1.1 | Tuesday 22 September 2026 | Business analyst | Issued | CR-01: the regulator is named the Information Commission, in the text and the context diagram. Links added to decisions logged after 1.0, such as DEC-13 and DEC-14 |
Problem statement
Requests for information reach the council through a shared mailbox, staff inboxes, the post and the phone. They are tracked in one spreadsheet, and each due date is typed in by hand . The regime is decided at the end, while the draft reply is checked (AS-06) . Nothing in the record shows how a deadline was counted, or whether it was restarted or extended .
Two laws apply to the same inbox. The Freedom of Information Act 2000 covers most information . The Environmental Information Regulations 2004 cover environmental information, which at a council means planning, waste, noise and much else . Environmental information is handled under the EIR, whatever law the applicant names .
Both regimes count 20 working days from the date of receipt . Around that clock they differ. A FOIA request must be in writing and give a real name, while an EIR request may be oral and needs no real name . FOIA has a cost limit . The EIR have no fixed cost limit. A refusal under regulation 12 needs an exception and the public interest test, and a manifestly unreasonable request is one such exception . Under FOIA, saying that the information is not held answers the request; under the EIR it is a refusal . A FOIA internal review is good practice under the Code, while EIR reconsideration is in the regulations . A regime decided late means the wrong rules may already have been applied. Under FOIA, for example, the cost limit comes before any exemption .
From 30 September 2026 the regulator is the Information Commission . Every refusal notice must tell the applicant how to reach it .
Who has the problem
- STK-07, the request coordinator, counts every deadline by hand and decides the regime last .
- STK-06, the information governance lead, owns the process but cannot show from the record that each deadline was met or lawfully moved .
- STK-08, the information owners, search before anyone has said which regime applies .
- STK-14, the performance and statistics owner, counts the quarterly statistics from a spreadsheet that holds no restarts or extensions .
- STK-01, the applicant, is entitled to an answer within 20 working days under either regime .
- STK-04, the Information Commission, can decide a complaint about any request .
Objectives
- One record for every request, from receipt to close, under both regimes.
- The regime decided at the start, for each part of a request (DT-01).
- Every deadline calculated from the published calendar, never typed, and reproducible from the record (NFR-04).
- Refusals, part refusals and extensions checked by a second role before they go (BR-57).
- The quarterly statistics produced from the record, in the seven measures (BR-55).
Scope
| Item | In or out | Why |
|---|---|---|
| Receiving and logging requests from every channel (TB-01, TB-02) | In | A request is received when it reaches anyone in the council (BR-22). |
| Routing each part and checking validity (TB-03, TB-04) | In | The regime decides every later rule (BR-05, DT-01). |
| The clock: day 1 and the deadline, clarification and extensions (TB-05, TB-06, TB-10) | In | Both regimes set their limits in working days (BR-17, BR-28). |
| Search, cost estimate and aggregation (TB-07, TB-08) | In | FOIA applies the cost limit before any exemption (BR-37). |
| Third-party consultation, the decision and its approval (TB-09 to TB-11) | In | Refusals need a named ground and a second check (BR-39, BR-44, BR-57). |
| Response, refusal notice and transfer (TB-12) | In | Each notice must contain the parts the law sets (BR-41, BR-47, BR-60, BR-61). |
| Records, reviews, complaints and statistics (TB-13 to TB-16) | In | Reviews, complaints and statistics come from the record (BR-51, BR-52, BR-53, BR-55). |
| Fees under FOIA and charges under the EIR | In the rules; out of release 1 | Most authorities do not charge (DEC-02). The rules stay in the register (BR-25, BR-38). |
| Requests for the applicant's own personal data | Out, except routing | They go to the subject access route (BR-06, DEC-07). |
| Third-party personal data (FOIA s.40(2), EIR reg. 13) | Out | Its rules changed in 2025 and 2026 and would date the files fastest (DEC-07). |
| Scottish public authorities | Out | The council is in England (DEC-01, DEC-07). |
| Sections 36 and 37 of FOIA, re-use licensing, the Welsh language, the longer limits in section 10(4) | Out | No specimen request needs them. Each would add rules without a new kind of analysis (DEC-07). |
| Choice of product | Out | Release 1 may be bought or built (DEC-14). |
Context diagram
The process sits in the centre. Every box around it is a party that sends something to the process or receives something from it. A dashed arrow carries flows that are not in release 1 (DEC-02).

Notation: context diagram. The rounded box is the process. Each square box is a party outside it. Each arrow is one direction between the process and one party, labelled with every flow it carries.
Success measures
Release 1 has worked when each measure below comes from the record, for any quarter, with no hand count. The seven statistics apply because the council has more than 100 full-time equivalent staff . No percentage target is set, because there is no baseline: the council's volumes are open question OQ-06 .
| Measure | Definition | Source of data | Tag |
|---|---|---|---|
| Requests received | Requests received in the quarter. EIR requests in a separate column (DEC-04). | Date of receipt; regime of each part | |
| Requests not yet processed | Requests received in the quarter and still open at its end. | Clock state at the end of the quarter | |
| Requests processed in full | Each processed request counted once: within the deadline, within an extended deadline or late. Target: none late, because the law sets the deadline. | Deadline; extension type; date the response was sent | |
| Granted in full | Requests where all the information asked for was given. | Outcome | |
| Refused in full | Requests where all the information asked for was refused. | Outcome | |
| Granted in part and refused in part | Requests where some information was given and some withheld. | Outcome | |
| Referred for internal review | Requests referred for internal review, reported once a year. EIR reconsiderations in the separate column (DEC-04). | Review requested | |
| Every deadline reproducible | Each deadline in the quarter can be worked out again from the record alone: date of receipt, restarts, extensions and calendar version (NFR-04; method in DEC-03). Target: all. | Request record; calendar version |
Assumptions and constraints
| Statement | Type | If it is wrong | Tag |
|---|---|---|---|
| The council is in England and is not listed in Part I of Schedule 1 to FOIA. Its cost limit is therefore £450, which buys 18 hours at £25 an hour. | Assumption | The limit would be £600, and DT-03 would need new thresholds. | |
| The council has more than 100 full-time equivalent staff. No headcount is given. | Assumption | The Code would not expect quarterly statistics, and seven of the success measures would lose their source. | |
| The starting point is a shared mailbox, a spreadsheet and due dates typed by hand. It was chosen, not observed. | Assumption | The as-is in 06 would have to be observed and redrawn. | |
| No fees under FOIA and no charges under the EIR in release 1. | Constraint | The fee and charge rules (BR-25, BR-38) would need requirements that are now Won't (release 1). | |
| Release 1 may be bought or built, and no product is named. | Constraint | The requirements would turn into a configuration guide for one product. | |
| The working-day calendar is the GOV.UK list of bank holidays, which ends on Tuesday 26 December 2028. | Constraint | A deadline after that date cannot be counted until the list is extended (RSK-01). | |
| From 30 September 2026 the regulator is the Information Commission. | Constraint | Notices would name a body that no longer exists (CR-01). | |
| The information governance lead approves refusals and extensions until the approver is named. | Assumption | The RACI and BR-57 change when OQ-08 is answered. | |
| The council's request volumes are not known. | Constraint | No target in 13 would be wrong, because none depends on volume. The success measures would get a baseline, and a target based on volume could be added to 13 (OQ-06). |
Specimen requests
The specimen requests are test scenarios. They are dated after the snapshot, in 2026 and 2027, so that every deadline can be counted on the published calendar and some fall on its awkward days. No request was received on these dates .
The first deadline for each request is the 20th working day after the date of receipt, or the 40th where the EIR allow an extension . A FOIA public interest extension, an internal review and an unanswered clarification run on their own periods . Non-working days come from the GOV.UK list for all three divisions . Day 1 is the first working day after the date of receipt .
In EX-06 the supplier's objection is recorded as a fact only: an objection was received. Its wording and its arguments are not given. The public interest factors used with EX-06 are general ones, each with its reason, and no decision of the regulator or of a tribunal is relied on .
| ID | Request | Channel and arrival | Rules and route | What it tests |
|---|---|---|---|---|
| EX-01 | The number of noise complaints recorded about one street | Email, arriving on Saturday 13 March 2027 | EIR: noise is a factor in the definition of environmental information . Not a routine enquiry, because it needs a count from the records (DT-01 R3). | A request that arrives on a non-working day. Day 1 is Monday 15 March 2027 and the deadline is Wednesday 14 April 2027. The count crosses 17 March (St Patrick's Day, Northern Ireland), 26 March (Good Friday) and 29 March (Easter Monday). The Code's reading (SRC-04 para 4.2) would give Thursday 15 April 2027: rejected by DEC-03. The same email at 23:58 on Friday 12 March 2027 has the same deadline. |
| EX-02 | Performance reports for the waste collection contract | Phone call on Tuesday 16 March 2027 | EIR. An oral request is valid without an address, so contact details are asked for and the call is logged (DT-02 R2). | An extension for complexity and volume. The deadline, 20 working days after receipt, is Friday 16 April 2027, and the notice goes by that date. The new deadline is Monday 17 May 2027, 40 working days, crossing 3 May (Early May bank holiday). That the reports are complex and voluminous is the author's assumption . |
| EX-03 | "All information about agency staff" | Email on Friday 27 November 2026 | FOIA. Too vague to locate, so the council asks for clarification (BR-23). | Clarification restarts the clock. Before it, the deadline was Wednesday 30 December 2026, crossing 30 November (St Andrew's Day, Scotland), 25 December and 28 December. Clarification is asked for on Tuesday 1 December 2026. The reply arrives on Monday 7 December 2026 and becomes the date of receipt. The new deadline is Friday 8 January 2027, crossing 25 and 28 December, 1 January and 4 January (the substitute day for 2 January, a bank holiday in Scotland). With no reply, the request closes on Monday 1 February 2027 (BR-24, DEC-09). |
| EX-04 | The council's spending on consultants | A message to a council account on a social media platform that nobody monitors, on Thursday 4 February 2027 | FOIA. Whether the council has a formal, monitorable presence on that platform is OQ-01. Until it is answered, the message is treated as received, as the fallback for OQ-01 requires (BR-12). | A channel nobody watches. The deadline is Thursday 4 March 2027. |
| EX-05 | The council's IT spending, signed "Concerned Resident" | Email on Tuesday 9 February 2027 | FOIA: not valid, because it gives no real name (DT-02 R6). Advice and assistance follow (BR-16). | One sender under two regimes. No FOIA clock starts. The same sender asking for air quality readings would make a valid EIR request (DT-02 R1), due on Tuesday 9 March 2027. |
| EX-06 | The pricing schedule of the council's IT support contract | Email reaching the council's server at 23:30 UTC on Thursday 8 July 2027, which is 00:30 on Friday 9 July 2027 in UK local time (DEC-13) | FOIA, section 43, commercial interests: a qualified exemption. The supplier is consulted, and an objection is received. After the public interest test, part is released and part withheld, with the public interest reasons in the notice that gives the decision (BR-61). | Time zone and a public interest extension. The refusal notice under s.17(2) goes by Tuesday 10 August 2027, with an estimate, crossing 12 July (Battle of the Boyne, Northern Ireland) and 2 August (Summer bank holiday, Scotland). The UTC date would give Monday 9 August 2027, which is wrong. The public interest decision is due by Wednesday 8 September 2027, a further 20 working days, crossing 30 August. Internal review is asked for on Monday 1 November 2027. The 40 working days run from the decision of 8 September 2027 and close on Wednesday 3 November 2027 (DEC-08). Counted from the s.17(2) notice, they would have closed on Wednesday 6 October 2027. The review reply is due by Monday 29 November 2027. |
| EX-07 | Emails between HR and Finance about staff restructuring | Three requests from three people on the same template, each for a different year: emails from 2024, 2025 and 2026. They arrive on Monday 1, Wednesday 3 and Monday 8 February 2027 | FOIA. Each alone is under the limit (DT-03 C1 = N). They relate to similar information (SRC-02 reg. 5(2)), and the same template arriving three times within eight days makes them appear to be a campaign (C3 = Y) . Aggregated, they exceed the limit (DT-03 R6). | Aggregation. Estimates in hours, in the four activities of BR-33: 2024: determine 1, locate 3, retrieve 2, extract 3, total 9. 2025: 1, 3, 2, 3, total 9. 2026: 1, 2, 2, 3, total 8 . Together 26 hours, or £650 at £25 an hour, over £450 (C4 = Y) . Confirming or denying alone is under the limit (C5 = N). Each request keeps its own deadline: Monday 1 March, Wednesday 3 March and Monday 8 March 2027. All three are refused under s.12, with advice on narrowing (BR-36). |
| EX-08 | The applicant's own complaint file, and the council's complaints policy | Email on Monday 15 March 2027 | Mixed. The applicant's own personal data goes to the subject access route (DT-01 R1). The policy is handled under FOIA (DT-01 R4, BR-08). | A request split between routes. The deadline for the FOIA part is Thursday 15 April 2027. |
Case one-pager
| Challenge | Approach | Decisions | Evidence |
|---|---|---|---|
| One inbox, two regimes that count the same 20 working days but differ on almost everything around them, and due dates typed by hand . Nobody could show how a deadline had been counted, or which regime had been applied and when. | Sources first: every law and guidance document in one register, with the date it was last checked (05). Then the rules, one per row, with the words of the law beside each (09). Rules with several conditions became decision tables (10). The rules about time became a state model (07). Requirements, stories and tests followed, each traced back to a rule. | Day 1 is the first working day after the date of receipt, as the regulator counts it. The Code's reading would make the deadline one working day later (DEC-03). Third-party personal data stays out of scope. Including it was rejected: its rules changed in 2025 and 2026 and would date the files fastest (DEC-07). The date of receipt is taken in UK local time, not the server's UTC date, which moves a request that arrives just after midnight in summer (DEC-13). | Every expected deadline in the test cases is checked by a formula against the published calendar (18, SRC-08). The traceability matrix links every requirement to its rules and its tests (19). CR-01 shows a change handled after the baseline: the regulator's new name, the Information Commission, fixed for 30 September 2026 . |