FOI vs EIR for Employment Records - Cardiff

Labor and Employment Wales 4 Minutes Read · published February 12, 2026 Flag of Wales

In Cardiff, Wales, choosing between a Freedom of Information (FOI) request, an Environmental Information Regulations (EIR) request or a Subject Access Request (SAR) determines how and whether employment records are released. Public bodies, including Cardiff Council, handle FOI and EIR requests under UK law but personal employment records are often handled under data protection rules. This guide explains when each route applies, practical steps to get employment information or personal files, and how Cardiff’s enforcement and review routes work.

If you want your own employment file, use a Subject Access Request rather than FOI in most cases.

When to use FOI, EIR or a Subject Access Request

FOI is for recorded information held by public authorities about their activities; it is not a substitute for a SAR when you seek your own personal data. EIR applies only to environmental information and is unlikely to be the right route for routine employment records unless the records specifically concern environmental functions. A SAR under data protection law is the usual route to obtain your own personnel file and other personal data held by a public employer.

  • FOI: seek non-personal or aggregated employment data, policies, pay scales, or anonymised statistics.
  • EIR: relevant only where employment records are environmental information, such as records about staff involved in regulated environmental work.
  • SAR: request your personal employment records, disciplinary notes, and other personal data.
Public authorities commonly redact third-party personal data from FOI responses to protect privacy.

Practical steps to decide

  • Identify whether the information you want is personal data about you, personal data about another identifiable person, or non-personal organisational information.
  • If it is your personal data, submit a SAR to the data protection contact at the organisation.
  • If it is non-personal operational information, submit an FOI request to the public authority.

Penalties & Enforcement

Enforcement for information access involves internal reviews, regulator decisions and possible tribunal appeals rather than standard municipal fines. The statutory time limit for responding to FOI and EIR requests is 20 working days as set out in official guidance [1]. Cardiff Council publishes its FOI procedures on its website and handles requests through its access to information team.

  • Monetary fines: not specified on the cited page.
  • Enforcement and decision notices: the Information Commissioner can issue decision notices and order release or corrective steps; specific financial penalties for FOI breaches are not listed on the cited guidance.
  • Escalation: internal review, ICO complaint and then appeal to the First-tier Tribunal are the usual routes; precise time limits for tribunal appeals are not specified on the cited page.
  • Enforcer: the Information Commissioner’s Office handles complaints and enforcement for FOI/EIR compliance and Cardiff Council is the responding authority for local matters.
  • Non-monetary sanctions: orders to disclose information, decision notices, and remedial steps; criminal sanctions are not cited on the referenced guidance.
If a public body withholds information, you can complain to the ICO who may issue a decision notice.

Applications & Forms

Cardiff Council accepts FOI and information access requests through its published online procedures and contact points; for personal data you should use the authority’s Subject Access Request process. Specific form names or fees are not specified on the cited page for FOI/EIR responses, though the council provides guidance on how to submit requests and contact details on its access pages.

  • How to apply: follow the council’s published FOI or data protection submission routes (see Help and Support section below).
  • Fees: FOI and EIR fees or chargeable disbursements are not specified on the cited guidance.
  • Deadlines: statutory response time is 20 working days for FOI/EIR per official guidance [1].

Action steps

  • For your own employment records: submit a Subject Access Request referencing the specific date range and document types you need.
  • For non-personal employment information: submit an FOI request describing the records and preferred format.
  • If your request is refused or redacted, ask for an internal review, then complain to the Information Commissioner if unsatisfied.

FAQ

Can I use FOI to get my own personnel file?
A FOI request may not be appropriate for your own personal data; a Subject Access Request under data protection is usually the correct route.
When is EIR appropriate for employment records?
EIR applies only to environmental information, so use it only if the employment records concern environmental functions or environmental decision-making.
How long will a public body take to respond?
Statutory response time for FOI and EIR requests is 20 working days under official guidance [1].

How-To

  1. Decide whether the information is personal data about you, personal data about someone else, or non-personal organisational information.
  2. If it is your personal data, identify the data controller and submit a Subject Access Request with proof of identity.
  3. If it is non-personal, draft a clear FOI request describing the records and preferred format and submit to the public authority’s FOI contact.
  4. If refused, request an internal review; if still dissatisfied, complain to the Information Commissioner and consider appeal to the First-tier Tribunal.

Key Takeaways

  • Use a SAR to obtain your own employment records; FOI is for non-personal or aggregated information.
  • EIR rarely applies to employment records unless they are environmental in nature.
  • Statutory FOI/EIR response time is 20 working days and the ICO handles complaints and decision notices.

Help and Support / Resources