A denial rarely arrives as a plain "no". It arrives as a number, a subsection, a paragraph of statutory language pasted in a shade lighter than the rest of the letter. That is the moment many requesters give up — and it is exactly the moment an experienced investigator starts reading more carefully. Exemption lists are not just obstacles. They are a map of what an agency believes it needs to protect, and often a hint about where the material worth fighting for actually sits.

What follows is a working overview of the categories that come up again and again, the ways they are applied in practice, and the moves that reliably improve your chances of getting documents rather than citations.

What an exemption actually does

Most access regimes begin with a presumption of disclosure and then carve out categories of protected material. The list of categories matters less than two design details buried inside it. First, whether an exemption is harm-based or class-based: a harm test forces the agency to explain what specific damage disclosure would cause, while a class exemption covers whole types of documents without further argument. Second, whether the exemption is absolute or subject to a public interest override that lets a reviewer weigh the benefit of release against the harm claimed.

There is a third detail that requesters overlook constantly: severability. In most systems the agency must release the non-exempt parts of a record and withhold only what genuinely falls within an exemption. A page of black bars with no explanation of which exemption applies to which redaction is not a compliant response in many jurisdictions — it is a reviewable defect. Say so, in writing, early.

The usual suspects

Personal privacy

Names, home addresses, signatures, health details, personnel files, family circumstances. This is the most frequently cited and most frequently over-applied category. The general principle worth holding onto is that privacy expectations shrink as a person's role becomes more public. The name of a junior clerk processing a form may reasonably be redacted; the names of officials who made or signed off on a contested decision usually should not be. If the agency has redacted the identity of decision-makers, ask why their private interest outweighs the public interest in knowing who acted.

Investigations and law enforcement

Informant identities, investigative techniques, witness details, material that would prejudice a live case. Note what the exemption usually protects: harm to an ongoing process, not the topic itself. Once a case is closed, or once a matter has been publicly announced, much of the surrounding paperwork becomes harder to justify withholding. Ask specifically for documents that postdate the conclusion of the investigation.

Deliberative process and internal advice

Drafts, minutes, advice to ministers or executives, the messy middle of policymaking. Two limits are worth testing everywhere. Factual material bundled into advice is often not covered, even where the advice is. And the protection frequently lapses once the decision has been taken — the point of the exemption is to protect candour while a matter is live, not to seal the historical record.

Commercial confidentiality

Tender submissions, pricing models, trade secrets, contract terms negotiated with private suppliers. Where public money is involved, ask the agency to identify the concrete competitive harm to a named business rather than gesturing at "commercial sensitivity". A generic assertion is a weak assertion.

Legal privilege, national security and statutory secrecy

Legal advice is commonly protected; the underlying facts given to the lawyers generally are not. National security and dedicated secrecy statutes are broad, but in most review systems classification is not self-justifying — a stamp is a claim, not a conclusion. Expect these to be the hardest fights, and budget accordingly.

How agencies apply them

Watch for a handful of familiar patterns. Fragmentation: each document is harmless, but assembling them, the agency says, would reveal something protected. Boilerplate: the same exemption number pasted across forty pages without variation. Scope creep: an entire file withheld because one paragraph inside it is sensitive. Soft denial by process: clarification requests that reset the clock, or a fee estimate large enough to end the conversation without ever refusing anything.

None of these are necessarily bad faith. Records officers are often overworked, risk-averse, and advised by lawyers who are paid to be cautious. That is precisely why the response needs to be challenged on paper, calmly, with specifics.

Reading a refusal like an investigator

Before drafting anything, work through the response line by line.

1. List every exemption cited and the exact words used to justify it.
2. Mark each redaction you can see and ask which exemption covers it. If the answer is not stated, request a redaction schedule.
3. Separate what was withheld entirely from what was released with deletions — the second category is usually the more promising target.
4. Check whether the agency addressed severability at all.
5. Note what it did not say: no harm explained, no time period given, no volume estimate.
6. Compare the language to the statute. Citations that do not match the material are common and easy to point out.

Challenging an overbroad withholding

Narrow the request before you appeal. A demand for "all documents relating to the project, 2015–2024" invites a volume refusal; a request for the four quarterly reports sent to the board is hard to refuse and often more revealing. Where you suspect a specific record exists, name it — meeting minutes, a signed contract, an inspection report, an email attachment referenced in a published document.

Then ask for the harm, not the conclusion. A short letter requesting that the agency identify the specific damage each exemption is meant to prevent, and confirm whether non-exempt portions can be released, puts the burden back where it belongs. If internal review or appeal is available, use it: it is usually free, it creates a record, and it sometimes reverses a decision made at a lower level without anyone having to admit a mistake.

Beyond that, escalation routes vary by country: an information commissioner, an ombudsman, a tribunal, a court. Timelines are often short, so diarise the deadline the day the refusal lands. Parallel requests to another agency holding the same document, or to a regulator rather than the department, can also break a logjam. And publishing the refusal itself is legitimate pressure — a well-written piece about what was withheld and why is often more effective than a second appeal.

A short field guide

Keep requests specific and dated. Ask for record types, not topics. Always request a redaction schedule and an explanation of harm. Cite severability. Appeal on time, in writing, with the exemption language quoted back. Keep a simple log of every request, deadline and response — most victories come from persistence rather than brilliance.

Access law differs sharply between jurisdictions, and the details above are general rather than jurisdiction-specific. Where the stakes are high, take advice from a local freedom-of-information advocate or a lawyer who works in this area before you commit to a long fight. And keep the refusal letters. They are documents too, and sometimes they tell you more than the records would have.

Photo: Ron Lach / Pexels