How to run an anonymous employee survey that stays anonymous

Calling a survey anonymous does not make it anonymous. Staff decide whether to answer honestly based on one question: could anyone work out that this answer came from me? If the answer is "probably", you get polite scores and empty comment boxes, and the survey tells you little.

Anonymity is not a setting you switch on. It comes from what you collect, how you report it and who can see the raw data. This article covers each of those in more depth than the short anonymity section in our guide to employee pulse surveys, and ends with a checklist you can use before launch.

Anonymous and confidential are different promises

An anonymous survey is one where nobody, including the people running it, can link a response to a person. A confidential survey is one where someone can make that link but promises not to share it. Both are legitimate. Problems start when a confidential survey is described as anonymous.

Confidential surveys have real uses. You might need to follow up on a safety concern, or link answers to tenure from your HR system. But then you have to say who holds the key, what they will do with it and what they will never do.

Pick one and describe it accurately:

• "Anonymous" means you collect no names, no emails, no employee IDs and nothing that stands in for them.
• "Confidential" means you name who can see identities and explain why.

Staff often test the promise. If a manager ever mentions something only one person could have written, people stop trusting the next survey, and the one after it.

Personalized links, sign-ins and identity fields

The most direct leak is collecting identity on purpose. Watch for these:

• A unique link per person, or a link that carries an employee ID or email address
• A sign-in step, even one used only to block duplicate answers
• An email or name question, even an optional one
• Reminders sent only to the people who have not responded, which requires knowing who has

The fix is one shared link sent to everyone, and reminders sent to everyone. You lose the ability to chase individuals. That is the price of anonymity, so accept it rather than working around it.

With Plumeform, respondents never sign in, so anyone with the link can answer, and no email address is collected unless your survey asks for one. Survey pages load no analytics or ad trackers. You can still undo all of this yourself by adding an email question or an identifier to the link, so check what your survey actually asks. The security page explains how Plumeform handles data more broadly.

Small reporting groups

Even with no identity collected, results can identify people. If a team of three reports an average satisfaction of 2.0, their manager can usually guess who is unhappy. The safeguard is an anonymity threshold: a minimum number of responses below which no result is shown.

Choose the number before you see any data. Five is a sensible floor for most workplace surveys. For sensitive topics such as harassment or misconduct, go higher, because the cost of identifying someone is much greater.

A threshold alone does not stop differencing, where you compare two overlapping groups. Here is a worked example:

• Sales: 10 respondents, average score 4.0, so the scores add up to 40
• Sales, excluding new hires: 9 respondents, average score 4.33, so the scores add up to about 39
• The one new hire therefore scored 40 − 39 = 1

Both groups were above a threshold of five, and one person's answer still leaked. Avoid publishing filters that differ by only a few people, and limit how many cuts you create.

In Plumeform, any survey can set a minimum group size of 3, 5, 7 or 10 on every plan, and the employee templates start with it on. No result describing fewer people is shown, and that includes filters to one team, cross-tab groups and every shared results link. A filter that leaves out too few people is hidden as well, which handles the case above.

The setting hides summaries, not individual responses. Everyone in the workspace can still open those, so decide who belongs in the workspace as carefully as you choose the number.

Demographics that add up to one person

Each demographic question looks harmless on its own. Combined, they identify people. In a 200-person company there may be exactly one woman over 50 in finance with more than ten years of service. If you ask all four, you have effectively asked for her name.

Ask only for the demographics you will act on, and keep them broad:

A few more habits help:

• Use department or location, not team, unless every team clears your threshold.
• Merge small categories before you report them.
• Make every demographic question optional and include "prefer not to say".
• Remove any question whose only purpose is curiosity.

This is the same reasoning used in de-identification: remove direct identifiers, then check whether the remaining details still single someone out.

Open answers that describe specific incidents

Comment boxes produce the most useful data and the most identifying data. A comment such as "At the March offsite, when I raised the budget problem, my manager cut me off" names an event, a role and a moment that others will recognize. Writing style, recurring phrases and spelling habits can identify people too.

You cannot fully control what people write, but your prompts shape it:

The second prompt asks about patterns and changes, not incidents, so the answers are easier to share safely. Then handle comments with care:

• Limit raw comments to one or two named people.
• Share themes and paraphrases with managers, not verbatim text from small groups.
• Remove names, dates, project names and other details that point to an event.
• Give serious allegations a separate, confidential channel.

For coding comments into themes, see how to write and analyze open-ended questions.

A checklist before you send

Work through this list for every anonymous employee survey:

1. 1Decide whether the survey is anonymous or confidential, and use that word accurately.
2. 2Send one shared link to everyone, with no identifier in it and no sign-in.
3. 3Remove name, email and ID questions, or move the survey to "confidential" and say so.
4. 4Set a minimum reporting group size before collecting, and go higher for sensitive topics.
5. 5Plan your reporting cuts in advance and drop any that differ by only a few people.
6. 6Ask only the demographics you will act on, in broad bands, all optional.
7. 7Write open prompts about patterns and changes, not incidents.
8. 8Name who can see raw responses and comments, and keep that group small.
9. 9Send reminders to everyone, never to a list of non-responders.
10. 10Tell staff exactly what you collect and who sees what.

Honest wording for staff is concrete about what you collect, who sees it and its limits. For example:

The last sentence matters. Admitting the one limit you cannot control makes the rest of the promise more believable. For more on running engagement programs that staff trust over time, see the employee engagement page.