How to keep an employee survey truly anonymous.

Saying a survey is anonymous isn't enough. Employees answer honestly when they have good reason to believe nobody can trace a response back to them, including by cross-referencing results. This article walks through the mechanisms that actually protect respondents, and the habits that expose them without anyone noticing.

Anonymous vs. confidential: two different promises

A confidential survey collects answers along with each person's identity, but commits to not sharing it. An anonymous survey reaches a point where a response can no longer be linked to a person. The first relies on trust in whoever holds the data; the second relies on how the data is stored.

Be clear about which one you offer. Promising anonymity while your tool keeps the link between a response and an account, even temporarily, damages trust the day someone finds out.

To prevent duplicate votes, a tool has to know who has answered while the survey is open. Say when that link gets deleted.

A minimum response threshold

The most important rule is simple: no result is published below a minimum number of responses. Under that threshold, an average or a distribution can reveal what an identifiable person answered.

A few guidelines:

• Set the threshold before the first round, and don't lower it midway to get a number out.
• Apply it to every published result: the whole organization, each team, each location, each tenure band.
• Apply it to the response count too: showing "2 responses" for a three-person team points straight at whoever didn't answer.
• Roll small groups into an "Other" category, which is itself subject to the threshold.

The cross-referencing trap

A threshold doesn't protect everything. Two published results, each above the threshold, can still let someone work out an individual answer by subtraction.

Two examples:

• The leftover. If you publish the organization's average and the averages of every team but one, the hidden team's average can be recalculated. You need to hide at least one more team.
• Near-identical groups. If a six-person team and its manager's reporting line differ by a single person, comparing the two results reveals that person's answer. Only one of the two should be published.

Every breakdown you add (team, location, tenure, manager) multiplies these overlaps, so keep the number of breakdowns small.

Lock groups in at the time of the response

An employee who changes teams between two looks at the results can end up exposed: their past answer shows up in the new team, and comparing before and after gives it away. The fix is to record the group at the moment of the vote, and never recalculate past results using today's org chart.

What gives people away without anyone noticing

• Overly detailed demographic questions. Age, exact job title and tenure to the month are often enough to identify someone. Ask for broad ranges, or nothing.
• Free-text comments. What someone writes can identify them. Warn respondents before they write, and keep verbatim comments out of documents that get passed around.
• Chasing people by name. A manager who personally nudges those who haven't answered shows they know who has.
• Timing. A result published right after a single person responds can point to them. Only publish once the survey has closed.
• Manager access. If managers can read their team's results, say so, and hold them to the same thresholds as HR.

Explain before you collect

Before the first round, publish a page that explains in plain language what is collected, who sees what, from how many responses, and how long data is kept. If your organization has employee representatives or a works council, inform them. Every claim on that page must stay true of the tool you actually use.

As an example, the Kwoji Pulse anonymity page describes these choices for Kwoji's pulse survey: no result below five responses by default (a threshold the organization's owner can set to four or three), groups locked in at the time of the vote, small groups rolled into "Other", and, seven days after a survey round closes, responses that are no longer linked to any account. Managers only see their team's average if the organization turns that on, and always above the threshold.

Beyond the tool: trust is built elsewhere

A well-protected survey only gets honest answers if employees see that their answers lead somewhere. Two habits help: publishing the results and what was done about them, and creating chances to talk outside of surveys.

Those chances can be very simple, like a short team game. In Kwoji Whisper, a sentence becomes a drawing, then a new sentence, and so on: the final result, usually far from where it started, gets the whole table laughing.

A moment like this measures nothing; it keeps up the habit of talking to each other. Our articles on how to calculate and read an eNPS and how often to run a pulse survey round out this guide, and the business page covers everything Kwoji offers.

A checklist before you launch

1. Anonymous or confidential: which one, in writing?
2. What minimum threshold, applied to which results, response counts included?
3. How many breakdowns, and have the overlaps been checked?
4. Are groups locked in at the time of the vote?
5. Who reads the comments, and where are they shared?
6. When is the link between a response and an account deleted?