Anonymous survey best practices

Anonymous survey best practice comes down to five habits: decide whether the survey is truly anonymous or only confidential, strip every identifier from the link and the questions, keep segments broad enough that no answer points to one person, tell people exactly who reads what, and report in groups large enough to hide individuals. Software settings help, but the questions and the report are where anonymity usually fails.

Anonymous or confidential: decide first

An anonymous survey cannot tell who answered. A confidential survey can, but restricts who sees the link between a person and an answer. The difference matters because each one allows different things: a confidential survey can chase non respondents and follow up a serious concern, and an anonymous one cannot. The note on anonymous versus confidential surveys sets out the test in detail, so this guide assumes the decision is anonymous and focuses on keeping that promise.

Write the promise as one sentence before writing a single question. The employee pulse survey from a fictional logistics company does this on its welcome screen: the same six statements as last month, and nobody sees individual answers. Every later choice, from the link to the team question, is then tested against that sentence.

What to strip from the form

Direct identifiers are the obvious part: name, email, phone, employee number. Less obvious is the way the survey arrives. Survey platforms record a surprising amount by default. SurveyMonkey’s own help page says its web links record respondent IP addresses by default, and that email invitations include each respondent’s email address in the results unless anonymous responses are switched on before sending. Other tools differ, so check what yours stores rather than assuming.

The route in matters as well. A shared link is anonymous; a personal link, a tracked invitation or a required sign in ties the response to someone even if the survey never asks a name. If you need to keep outsiders away, a password shared with the whole group does that without identifying anybody.

Then read every question as if you were trying to work out who wrote it. Date of birth, exact job title, start month and site name each look harmless. Together they often describe one person.

The small group problem

The Australian privacy regulator treats information as personal when a person is reasonably identifiable from it, and its de-identification guidance stresses that the risk has to be judged in context, including what the reader already knows. In a workplace survey the reader is often a manager who knows every person in the team, which is the hardest context there is.

The fix is to keep segments broad and to refuse to report small groups. The pulse survey asks for team only, from five broad options, and its team question says a team under five responses is never reported on its own. The thank you screen repeats the rule, so the promise is made twice at the moments people decide whether to be frank.

The 360 feedback form uses the same idea for a harder case. Its welcome screen says the person being reviewed gets a report only once at least four people have replied, and never a single response on its own. The exit interview form goes further in the other direction: team level is as specific as it gets, and a separate question asks whether the answers may be shared with the manager, with a named, an unnamed summary or a no option. Exit surveys are the hardest case for anonymity because the leaver is often the only person who left that month, which is why the guide on running an exit interview survey recommends promising confidentiality there rather than anonymity.

The Australian Bureau of Statistics describes two kinds of breach that apply directly to small surveys: re-identification, where the person is worked out, and attribute disclosure, where something about them is revealed without formally naming them. A table showing that the only two people in a site both rated their manager poorly is the second kind.

Telling respondents what happens

People answer honestly when they know the rules. Put these points on the first screen, in plain sentences:

• that the survey is anonymous, and what that means in practice
• what is recorded, including the one segment you ask for
• who reads the raw answers, by role
• the smallest group that will ever be reported
• that comments are summarised rather than quoted, if that is the case
• how long raw responses are kept

The course evaluation form from a fictional training institute is a good model for length. Its welcome screen says three rating grids and two open questions, nothing identifies you, and results go to the trainer as averages. It segments by class, never by trainer, so nobody has to rate a named colleague.

Avoid words you cannot stand behind. “Completely anonymous” is a claim one respondent can disprove by spotting a tracked link, and that person will tell everyone else.

Reporting without exposing anyone

Most anonymity is lost after the survey closes. Four reporting rules prevent it.

Apply the threshold everywhere. If teams under five are hidden in the summary, they must be hidden in every chart, filter and export shared beyond the analyst.

Summarise open comments. A phrase, a project name or a date can be recognised. Group comments into themes and paraphrase them. The pulse survey makes both open questions optional, so the six rated statements always get answered even by people who have nothing they want to put in writing.

Watch the timing. A response submitted at 11.40 on the one morning a small team was offsite narrows the field. Do not share raw submission times with anyone who knows rosters.

Limit the raw file. The raw export should stay with one or two named people, and be deleted on the date you promised.

The checklist

The table at the end of this article turns the practices above into ten checks, each with the reason and a way to test it before the link goes out. Work through it with the draft form open. The two rows most often skipped are the add-on check and the deletion date, because neither shows up while the survey is being built.

Common mistakes

A required email “for the prize draw”. This turns every response into an identified one. Run the draw from a separate form linked on the thank you screen.

Too many demographic questions. Each extra segment multiplies the chance that a combination points to one person. Ask only the segment you will actually report on.

Quoting comments word for word. Even a short quote can be recognised by the person it describes or the colleague who heard the story.

Forgetting the inbox. An email alert that copies each response to a manager’s address has quietly changed who reads raw answers.

Changing the promise mid survey. Adding a name question after some people have answered means earlier respondents agreed to rules that no longer apply.

For wording the questions themselves, the guide on how to write survey questions covers leading and double barrelled questions, which matter just as much in an anonymous survey.

Build it

A form here has one of four access types: public, secret key, login required or domain restricted. For an anonymous survey, public or secret key keeps the route in shared rather than personal, and the page on controlling who can fill in a form compares all four. A stored response holds the answers, the time it was submitted and the form version it was submitted against; it has no field for a name, account or network address unless the form itself asks for one.

Be deliberate about add-ons. Email alerts send the submitted values to one address, and webhooks post each response to another system, so either one widens who sees raw answers. Partial responses are not stored, so an abandoned survey leaves no record. The tutorial on viewing, exporting and managing responses covers the responses table and the CSV export, which is where the reporting rules above are applied.