Public Procurement and Property

FOI and Contractors: What’s Changed?

June 18, 2026 by Scottish Procurement No Comments | Category Procurement news, Scottish Procurement

The Section 60 Code of Practice for Freedom of Information (FOI) and Environmental Information Regulations (EIR) was updated on 25 March 2026, bringing refreshed guidance for Scottish public bodies.

One of the key updates focuses on something many organisations deal with every day – services delivered by external or outsourced partners.

Looking beyond your organisation

A central message in the updated Code is straightforward: when responding to FOI or EIR requests, don’t just look at the information you hold directly. The law also covers information held on your behalf. That could include information held by contractors delivering services for you.

The revised guidance encourages authorities to take a more active approach and think carefully about whether relevant information might sit with a supplier or delivery partner, not just within their own systems.

Two new sections in the Code add clarity on how to approach this in practice.

Information held by contractors

The updated guidance makes it clear that information held by a contractor can fall within scope where it relates to services being delivered on behalf of an authority. Especially where those services are part of the authority’s own functions. In these situations, it’s worth considering:

• what the contract says about information and access
• whether the information relates to delivering a public service
• and whether you need legal advice if it’s unclear whether the information is ‘held’ for FOI purposes

Handling requests in practice

The new paragraphs also reinforce the purpose of FOI law to provide transparency about public services, however they are delivered. That means when a request comes in, authorities should consider whether the contractor be holding relevant information on our behalf?

If the answer might be yes, particularly where the contractor is delivering a service the authority is responsible for, then the authority may need to go to the contractor to get that information in order to respond. Importantly, the responsibility doesn’t shift – it remains the authority’s duty to comply with FOISA and the EIRs.

The Code also points to Commissioner Decision 094/2013 as a useful example of how these relationships can be interpreted. But where there’s doubt, seeking independent legal advice may still be appropriate.

Why this matters

For those involved in procurement and contract management, this update is a timely reminder that information responsibilities don’t stop at organisational boundaries.

In practice, that might mean:

• building clear information-sharing expectations into contracts
• working closely with suppliers when requests come in
• and keeping track of where information about public services is actually held

Next steps

Scottish public authorities are encouraged to familiarise themselves with the updated Code of Practice and consider what it means for their existing and future contracts.

For further information on public procurement in Scotland please visit www.gov.scot/procurement

Please email enquiries to scottishprocurement@gov.scot

Subscribe to our blog to keep up to date with the latest news across the procurement community.

Comments