Neither confirm nor deny (NCND)

What this response means#

The authority is refusing to even tell you whether it holds the information you asked for. This is known as a “neither confirm nor deny” response, or NCND. Under section 18 of FOISA, an authority can give this response when simply confirming or denying that it holds information would itself reveal something that is exempt.

This is a legitimate tool, but it is sometimes misused. The key test is not whether the information itself is sensitive - it’s whether the act of saying “yes, we have it” or “no, we don’t” would cause the harm that the underlying exemption is designed to prevent.

What the authority must show#

For an NCND response to be valid, the authority must:

1. Cite a specific exemption - NCND isn’t a standalone power. The authority must say which exemption it is relying on and explain why confirming or denying would engage that exemption. Only some exemptions can support NCND: sections 28 to 35, 38, 39(1) and 41. An NCND response based on any other exemption has no legal basis
2. Show that revealing the true position would be harmful - saying whether the information exists or is held must itself cause the harm the exemption protects against. Because authorities must use NCND consistently to avoid signalling the answer, a seemingly harmless “no” does not automatically defeat NCND - but the claimed harm from revealing the true position must be real, not speculative
3. Carry out a public interest test - under section 18(1), the authority must be satisfied that revealing whether the information exists would be contrary to the public interest. This applies to every NCND response, whatever the exemption
4. Apply this consistently - NCND only works if the authority gives the same response regardless of whether it actually holds the information

Things to check#

• Did they tell you which exemption they’re using? NCND must be anchored to a specific exemption. If the authority just said “neither confirm nor deny” without citing a section of FOISA, that’s a procedural error.

• Is the NCND plausible for what you asked? Think about whether confirming or denying would genuinely reveal something sensitive. For a question like “do you hold records about national security operations targeting [named individual]?”, NCND makes sense - either answer reveals something. For a question like “do you hold minutes of your board meetings?”, it doesn’t.

• Did they do a public interest test? The authority must always carry out a public interest test on an NCND response, whichever exemption it relies on. This test considers whether the public interest in maintaining the NCND response outweighs the public interest in confirming or denying.

• Have they confirmed or denied in other contexts? If the authority has already publicly acknowledged holding this type of information - for example, in published reports, press releases, or responses to other requests - then NCND may no longer be sustainable.

Understanding NCND#

NCND can be confusing and frustrating. Here’s the logic: imagine an authority that holds intelligence files on some people but not others. If it said “yes, we hold a file on you” to some people and “no, we don’t” to others, the “no” responses would be meaningful - they’d confirm the person wasn’t a subject of interest. So the authority must say “neither confirm nor deny” to everyone, regardless of whether a file exists.

But this logic doesn’t apply to most types of information. Authorities sometimes use NCND to avoid engaging with difficult requests when a straightforward exemption would be more appropriate. The questions below will help you assess whether NCND has been properly used in your case.

Use the interactive tool#

Answer the questions below to check whether the NCND response has been properly applied to your request.