Anonymous survey

Anonymous is not confidential

The two words are used as synonyms and mean different things, and promising the wrong one is a breach of trust that people notice.

• Anonymous — you do not know who answered, and cannot find out. There is nothing in the dataset that identifies anyone, so there is nothing to leak, subpoena or accidentally join to another table.
• Confidential — you know who answered and you undertake not to reveal it. Perfectly legitimate, often necessary (you cannot follow up a safeguarding disclosure in an anonymous survey), but it is a promise about behaviour rather than a property of the data.

If your survey has a resume link, a hidden identifier, or an email question, it is confidential. Say confidential. Under UK GDPR, confidential responses remain personal data with all that follows: a lawful basis, a retention period, and the ability to honour a subject access or erasure request. Genuinely anonymous data is outside the scope of data protection law altogether — which is exactly why the bar for calling it anonymous is high.

What quietly breaks anonymity

• A hidden field carrying an identifier. A staff number or case reference in the link means every response is attributable, whether or not anyone looks.
• Small subgroups. "Female, band 8a, Estates" may be one person in your organisation. Cross-tabs are where anonymity usually dies — set a minimum group size for reporting (five is a common floor) and suppress below it.
• Free text. People sign their comments, describe an incident only they were present at, or name their manager. See open-ended questions.
• File uploads. A photograph has location metadata; a document has an author field.
• Rejoining. Anonymous data that you match back to a CRM record by timestamp was never anonymous.

A worked example

An employee engagement survey promises anonymity. It collects: directorate, grade, length of service in bands, whether the respondent has a disability, and a free-text "what one thing would you change?".

No name, no email, no login. But in a directorate of 40 people, "grade 7, under 1 year, disabled" is likely to be one individual, and the free text will make it obvious. The survey is technically anonymous and practically not.

Fixes: collect directorate at a coarser level, band length of service more widely, commit in writing to suppress any cell under five, and tell respondents that free text will be summarised rather than reproduced verbatim — then do that.

How to say it in the survey

Be specific rather than reassuring. "We do not ask for your name and we cannot identify you from your answers. We report results in groups of five or more. Please do not include names in your comments" beats "your responses are completely anonymous", which is a claim most surveys cannot support.

In NumoForms

Anonymity is a design decision you make, not a switch. The product does not require respondents to log in, so a survey that asks for no identifying information and carries no identifier in its link collects no identifying information. What you should check before promising anonymity:

• No email or address question, and no name in a short-text question.
• No hidden field that carries a person rather than a channel — "source=leaflet" is fine, "staff_id=48221" is not.
• Whether you need save and continue. A resume link is keyed on a token; anyone holding that link can return to a part-finished response.
• Whether file uploads are worth the risk for this survey.

On the storage side, responses are held in the UK — see data residency — with row-level security and org isolation pinned server-side, and uploads in a private bucket read through short-lived signed URLs. Details are on the security page, and the assessment you may be asked for is a DPIA.