The Information Commissioner has issued an enforcement notice under section 52 of the Freedom of Information Act 2000 against King's College London (KCL), requiring the university to publish an action plan by 17 August 2026, clear its backlog of overdue requests, and achieve a 90% in-time compliance rate by the end of the year, after finding systemic weaknesses in its request-handling arrangements resulting in persistent non-compliance with statutory timescales.
The notice, dated 10 July 2026,records continuing non-compliance with section 1(1) FOIA and a continuing breach of section 10(1), which together require a public authority to confirm whether it holds requested information and communicate it within 20 working days.
By 17 August, KCL must publish on its website an action plan, supported by a lessons learned exercise identifying the root cause of delays, which formalises measures to mitigate them. By 29 January 2027 it must respond to every request that was outside the 20-working-day limit at the date of the notice, either communicating the information or issuing a valid refusal notice under section 17, achieve an average in-time compliance rate of 90% for the quarter from 1 October to 31 December 2026, and have no open requests over three months old, excluding those subject to a valid public interest extension. Failure to comply can be certified to the High Court under section 54 FOIA, with the authority liable to be dealt with as if it had committed a contempt of court.
On 23 April 2026, KCL proactively told the ICO it was experiencing significant delays, citing unprecedented volumes of FOI and subject access requests alongside substantial staff turnover in its information rights function. A subsequent compliance review found that KCL's compliance with statutory timescales in 2025/26 had fallen to 58%, deteriorating to just 21% in the final quarter, and that of 126 open requests at 31 March 2026, 76 were overdue, including requests unanswered for more than nine months.
The position then worsened rather than improved. By 1 June 2026, KCL reported 172 open requests, of which 127 were overdue. This represented around 74% of its open caseload with 33 requests more than three months old. KCL told the Commissioner there had been periods when only one member of staff had dedicated responsibility for FOI work, and that it had since recruited a replacement, moved to a model in which all three team members contribute to FOI and SAR handling, and was seeking approval for additional resources and a revised structure.
The Commissioner acknowledged KCL's constructive engagement and its evidence on staff turnover and recruitment difficulties, but said resource and organisational challenges do not remove statutory obligations, and that public authorities are required to organise their affairs so as to ensure compliance with the legislation. He also noted the proposed remedial measures had not yet been implemented.
The notice separately recorded that only 65% of KCL's internal reviews were completed within the timescales recommended by the section 45 Code of Practice during 2025/26, though the Commissioner declined to require specific remedial action on reviews, noting the number of overdue reviews remained low, while confirming he will continue to monitor performance.
The ICO pointed KCL towards the ICO's FOI self-assessment toolkit, highlighting its timeliness module, and reminded the university to continue meeting its subject access obligations under the UK GDPR while implementing the required steps. KCL has a right of appeal to the First-tier Tribunal within 28 days, and the notice need not be complied with pending determination of any appeal.
The enforcement notice is available at: https://ico.org.uk/media2/2mzpol2q/kcl-foi-enforcement-notice.pdf
