People dealing with HMRC frequently use “Freedom of Information request” and “subject access request” as if they were interchangeable. They are not and using the wrong one wastes a month and produces a refusal that tells you nothing useful. This guide explains, in plain terms, what each request actually gets you, why HMRC will almost always refuse an FOI request about your own tax affairs and how to use both together to build the fullest possible picture of what HMRC holds and knows.
On this page
The Quick Answer
Both routes are free, both are rights you already have under UK law and both can be exercised without a solicitor. The difference is what they were built to do. A subject access request exists to let you find out what an organisation knows about you specifically. A Freedom of Information request exists to let anyone find out what a public body like HMRC knows or does in general. HMRC treats these as two entirely separate processes, handled under two different laws, by two different teams and a request sent under the wrong heading will usually just be refused rather than redirected.
What a Subject Access Request Gets You
A subject access request (DSAR) is made under the UK GDPR. It is personal: it only works for information that relates to you as an identifiable individual. Against HMRC, this typically means case notes on your enquiry or investigation, any risk score or classification applied to you, internal commentary on your behaviour, third-party information HMRC has received about you and records of decisions made about your case.
HMRC can withhold specific items from a DSAR where disclosure would genuinely damage an ongoing tax assessment or criminal investigation, but it has to justify this item by item – it cannot refuse your whole file just because a case is open. We cover this route in full in our companion guide, How to Make a Subject Access Request to HMRC.
What a Freedom of Information Request Gets You
A Freedom of Information request is made under the Freedom of Information Act 2000. It is impersonal by design: anyone, anywhere, can ask HMRC for recorded information it holds, regardless of whether they have any connection to it. Crucially, FOI cannot be used to find out about an identifiable person’s own tax affairs – including your own. Where you are asking about yourself, section 40(1) of the Act exempts your own personal data outright and simply redirects you to the data protection regime. Where you, or anyone else, asks about someone else’s identifiable tax affairs, HMRC is separately under a strict legal duty of confidentiality that overrides FOI wherever a request would reveal, or allow someone to work out, whose case is involved.
What FOI is genuinely good for is everything that sits above the level of an individual case: HMRC’s internal guidance and manuals, statistics on how often certain penalties are applied, the general criteria HMRC uses internally when deciding how to handle different types of case and information about HMRC’s systems and data-sharing arrangements in general terms.
Side-by-Side Comparison
| Subject Access Request (DSAR) | Freedom of Information Request | |
|---|---|---|
| Legal basis | UK GDPR, Article 15 | Freedom of Information Act 2000 |
| Who can use it | Only the individual the data is about | Anyone, for any reason |
| Gets you your own case file/notes | Yes – this is exactly what it’s for | No – almost always refused |
| Gets you internal guidance/policy | No | Yes, where not already published |
| Gets you statistics | No | Yes, in aggregated/anonymised form |
| Response deadline | 1 month (extendable by up to 2 more for complex requests) | 20 working days |
| Cost | Free (save for unfounded/excessive requests) | Free (HMRC can refuse if cost exceeds statutory limit) |
| Main exemption used by HMRC | “Crime and taxation” exemption (DPA 2018) | Section 40(1) for your own data; section 44 (via CRCA 2005 s.18) for anyone else’s |
| If refused, escalate to | ICO complaint, then court application | ICO complaint, then First-tier Tribunal (Information Rights) |
Common Mistakes
- Sending an FOI request about your own tax affairs. This is refused almost every time, because HMRC’s duty of confidentiality overrides FOI wherever your identity is specified or can be worked out. It wastes time you could have spent on a DSAR.
- Sending a DSAR and expecting policy or statistical answers. A DSAR only covers your own personal data – it will not get you HMRC’s internal criteria for selecting cases for investigation or statistics on how other cases were treated. That needs an FOI request.
- Accepting a blanket refusal without question. Both regimes require HMRC to justify a refusal with specific reasons, not a generic statement that the topic is sensitive. Push back and ask exactly what was withheld and why.
- Mentioning your own case in an FOI request. Even where the underlying question is genuinely about general policy, referencing your own case reference or specific facts can tip the request into the confidentiality exemption. Keep FOI requests fully general.
- Forgetting the one-month/20-working-day clock starts on receipt, not on the date you sent it and can be paused while HMRC verifies your identity for a DSAR.
Using Both Together
The two requests are not in competition with each other – used well, they answer different halves of the same question. A typical, effective combination for someone facing an HMRC enquiry or investigation looks like this: a DSAR to find out exactly what HMRC has recorded about your specific case, alongside a separate, carefully worded FOI request to find out the general criteria, statistics or guidance that puts your case in context. For example, a DSAR might reveal that your case was flagged by HMRC’s Connect system; a parallel FOI request, phrased generally, can then ask what categories of data feed into Connect, without ever mentioning your own case.
Send the two requests separately, to the right teams and avoid cross-referencing one in the other – mixing them tends to confuse the response and can slow both down.
Which One Do You Need? A Simple Decision Guide
Ask yourself what you are actually trying to find out:
- “What does HMRC know about me / my case?” – send a DSAR.
- “Why was I selected for this type of investigation?” – send a DSAR for case-specific notes and consider an FOI request for the general selection criteria HMRC applies to that type of case.
- “What does HMRC’s guidance actually say about this point?” – check the published manuals first; if the detail you need is missing, send an FOI request.
- “How common is this kind of penalty / outcome?” – send an FOI request asking for aggregated statistics.
- “Can I find out who reported me?” – a DSAR may reveal that a third-party report was received, though the identity of the reporter can usually still be withheld to protect their own data.
What Happens After You Send a Request
For a DSAR, expect HMRC to first confirm your identity if it has not dealt with you under that reference before, then either provide the information, explain that an extension is needed or set out which items are withheld and under which exemption. For an FOI request, expect either disclosure, a refusal citing a specific exemption (which should explain the reasoning, particularly for exemptions requiring a public interest test) or confirmation that HMRC does not hold the information in the form requested.
In both cases, read the response carefully against what you actually asked for. Partial or evasive responses are common enough that it is always worth checking the response addresses every category you listed, rather than assuming silence on a point means nothing exists.
Frequently Asked Questions
Can I use a Freedom of Information request to get my own HMRC file?
No. Section 40(1) FOIA exempts your own personal data outright. FOI requests are also treated as if made by anyone, and information about any identifiable person’s tax affairs is, separately, almost always exempt from disclosure under FOI, even to that person. You need a subject access request (DSAR) to get your own data from HMRC.
Can I make an FOI request and a DSAR to HMRC at the same time?
Yes, and it is often the right approach. Send a DSAR for your own case-specific data and a separate FOI request for general policy, guidance or statistical information. Keep the two requests separate and clearly labelled.
Which request is faster, FOI or a DSAR?
Both have similar headline deadlines – 20 working days for FOI, one calendar month for a DSAR. A DSAR can be extended by up to two further months for complex requests; FOI deadlines are generally less flexible, though public interest considerations on qualified exemptions can add time to a final decision.
Does it cost anything to make an FOI request or a DSAR to HMRC?
Both are normally free. HMRC can refuse an FOI request, without charge, where the cost of complying would exceed the statutory limit and can charge a fee for a DSAR only where the request is manifestly unfounded, excessive or for further copies of material already provided.