Ask who can connect the answer to the person

The employer, the survey provider and the person reading a report can have different access. Examine them separately.

A provider may hold a respondent roster to send invitations while withholding individual answers from the employer. Another system may collect responses without receiving the roster at all. Both designs still need to address what a report could reveal.

Confidentiality can be appropriate when a person needs direct help or an allegation requires follow-up. The issue is whether the promised privacy matches the purpose and the actual data flow.

Removing a name does not settle the question

An employee may remain identifiable from an unusual role, a particular event or a combination of attributes. A code can also preserve a connection to a person when the information needed to restore that connection exists.

Whether information qualifies as anonymous requires more than a label. Relevant context includes what the recipient receives and what other information can reasonably be used to identify someone.

SafePorter's protected survey workflow

The organization holds its roster and sends invitations from its own systems. SafePorter does not receive respondent names and email addresses from that roster. Responses are stored under an identifier that differs from the invitation ID.

The organization receives protected aggregates and insights, rather than individual responses. Written feedback is aggregated, and identifying detail is suppressed. Demographic surveys do not include free text.

Follow each step of the workflow

Assess the output too

A vendor's refusal to show names does not tell you whether a small-group result or distinctive comment can identify someone. Ask what happens to a result that is too small, too specific or recoverable from other reports.

SafePorter's reporting-protection page explains how it addresses those disclosure risks.

The useful comparison

Compare the information each party can actually obtain, the outputs available to the organization, and the evidence for the controls. Do not treat a marketing label as a substitute for those answers.

Further reading: the Information Commissioner's Office's introduction to anonymisation.

---

Bring the question your organization needs answered.

Request a demonstration