Anonymity and confidentiality in employee surveys: what to promise, and how to keep it.
People answer honestly when they believe their answers cannot come back to them. Survey invitations often promise that by saying “anonymous” when they mean “confidential”.
On this page
- Two different promises
- What to promise
- How to keep it: seven reporting rules
- Set a minimum group size, and never report below it
- Close the subtraction gap
- Limit crossed breakdowns
- Ask only the demographics you will use
- Treat free text as identifiable
- Keep response tracking at group level
- Do not hand over record-level data
- UK GDPR: the basics
What to tell people, seven reporting rules that keep the promise, and the UK GDPR basics.
Two different promises
A survey is anonymous when nobody – not the organisation, not the provider, not IT – can tell whose answers are whose. It is confidential when someone can, often an independent provider, but undertakes never to report results in a way that identifies anyone. The set-up decides which one you can honestly offer.
| Set-up | Who can link answers to people | Honest description |
|---|---|---|
| Open link, no login, no personal details | Nobody, unless demographic answers single someone out | Anonymous, as long as the reporting rules hold |
| Personal link from an independent provider, reminders to non-responders | The provider, not the organisation | Confidential: anonymous as far as the organisation is concerned |
| Internal system with logins, run by HR | HR or IT | Confidential at best; say exactly who can see what |
| Interview or conversation | The interviewer | Attributable; say how notes are used and who sees them |
Neither promise is better in itself. A confidential survey can remind only the people who have not yet responded, attach department and length of service from HR records instead of asking for them, and stop anyone completing twice. An anonymous survey removes the need to trust anyone.
What matters is that the word on the invitation matches the arrangement behind it. Survey providers, ourselves included, often use “anonymous” to mean “anonymous as far as your organisation is concerned”. If you use it that way, say so in a sentence.
What to promise
Write the promise as a short list of commitments, each of which you can keep. For a confidential survey run by an outside provider, something like this:
Illustrative wording“Your answers go to [provider], an independent organisation. [Organisation] never sees individual answers, or who has and hasn’t responded. Results are only reported for groups of five or more, and comments are checked to remove names and identifying details before anyone here sees them. [Provider] will only release your individual answers if the law requires it.”
Every clause is a commitment. If you cannot keep one, leave it out rather than soften it; people notice the softened version.
How to keep it: seven reporting rules
Set a minimum group size, and never report below it
No result for any group with fewer responses than the minimum – not a score, not a percentage, not a comment. Five is a common choice, and it is our usual minimum; some organisations set a higher minimum, such as ten, for sensitive subjects and demographic breakdowns. Decide before launch, and say what it is in the invitation.
Close the subtraction gap
A minimum on its own is not enough. If a department’s overall result is reported and four of its five teams are reported separately, the fifth team’s result can be worked out by subtraction, however small that team is. When one group falls below the minimum, merge it with another; if the small groups together still fall short, merge in the next-smallest group until the combined group clears the minimum. The reporting threshold checker does this for you.
Limit crossed breakdowns
Gender within a team, or age band within a site, produces small groups fast. Apply the minimum to every cell of every table, and do not publish two breakdowns that could be laid over each other to isolate a group the minimum was protecting.
Ask only the demographics you will use
Every extra question narrows the group someone belongs to. Use bands rather than exact values (age bands, length-of-service bands), offer “prefer not to say” on every personal question, and drop any question you have no plan to analyse.
Treat free text as identifiable
People identify themselves in comments without meaning to: a role, an incident, a turn of phrase. Tell respondents this at the comment box. Have comments read, and names and identifying details removed, before anyone in the organisation sees them, and do not release comments at all for groups below the minimum.
Keep response tracking at group level
Managers can usefully see response rates for their area, but only where the area clears the minimum, and never a list of who has responded. Ask managers not to ask.
Do not hand over record-level data
A spreadsheet of individual responses with department, grade and length of service attached is identifiable even with the names removed. If analysts need record-level data, keep it with whoever runs the survey, or strip it to the fields the analysis needs.
UK GDPR: the basics
This is not legal advice, but the essentials are not complicated.
Confidential responses are personal data
If anyone can link a response to a person – including your provider – UK GDPR applies, even if your organisation never sees a name. The ICO’s guidance is explicit that pseudonymised data is personal data in the hands of whoever holds the additional information needed to re-identify people.
Anonymous means anonymous to anyone, by any reasonable means
Information is anonymous, and outside UK GDPR, only if no one is reasonably likely to be able to identify people from it, using the means reasonably likely to be used. The ICO asks you to picture a “motivated intruder” with ordinary resources, and warns about the mosaic effect: details that identify nobody on their own can identify someone in combination. Results for small groups are exactly where that risk sits.
Tell people, and collect only what you need
A privacy notice that says what you collect, why, who processes it and for how long; a lawful basis for the processing; and questions limited to what the analysis needs.
Take extra care with special category data
Questions on ethnicity, health or disability, religion or sexual orientation collect special category data. That needs a separate condition under Article 9 of UK GDPR. For the conditions employers usually rely on (employment, or equality monitoring), that also means a condition in Schedule 1 of the Data Protection Act 2018 and, usually, an appropriate policy document. Make these questions optional.
Put the provider under contract
An outside provider processing responses on your behalf needs a written processing contract covering security, confidentiality and deletion.
The ICO is reviewing its anonymisation and pseudonymisation guidance following the Data (Use and Access) Act 2025, so check the current version before relying on the detail.
To check which breakdowns of your own results can safely be shown, use the survey reporting threshold checker. For running the survey itself, see Running an engagement survey: a practical implementation plan.
Sources: ICO, Pseudonymisation and How do we ensure anonymisation is effective? (anonymisation guidance, under review following the Data (Use and Access) Act 2025), checked 16 October 2026; ICO guidance on special category data. great{with}talent’s own commitments are set out in our anonymity and confidentiality statement; our surveys, including WinningFormula, do not report on small groups (typically fewer than five). This page is not legal advice.
The clearest thirty minutes in your week.
Send us your last engagement survey and we’ll show you what it’s missing – no charge, no deck, no obligation. Or start with a pilot or a 30-minute conversation.