Anonymous employee surveys and the GDPR

Anonymous, confidential or pseudonymised?

The words get used interchangeably, but they mean very different things:

The distinction comes from the GDPR itself. Recital 26 says the rules don't apply to anonymous information, and that pseudonymised data which can be attributed to a person using additional information is still personal data. The test is whether someone could identify the person using means reasonably likely to be used, taking into account cost, time and available technology.

Many surveys described as "anonymous" are in fact confidential. There's no shame in that, but call it what it is. Employees who find out that "anonymous" meant something else won't answer honestly next time.

When is a survey truly anonymous?

Europe's data protection authorities, working together as the EDPB, are drawing up new guidelines on anonymisation. The version for public consultation was adopted on 7 July 2026 and succeeds an opinion from 2014. At their core are three criteria: No Record Isolation, No Linkage and No Inference. If all three are met, data may be regarded as anonymous. Translated into three questions you want to be able to answer "no":

1. Can you single out one person? For example, the only woman over fifty in the purchasing team.
2. Can you link data together? For example, the time an answer arrived to the moment Jan clicked "submit".
3. Can you infer something about someone? For example, if all three people in a team gave a 3, you know what each of them thought.

In employee surveys, these are the places it tends to go wrong:

• Small groups. A result for a team of three is a result for three known people. Don't show any breakdown below a fixed minimum, five for example.
• Combinations of characteristics. Department, age band and length of service may be harmless on their own and identify someone together.
• Personal links. A unique invitation link per person is handy for reminders, but as long as that link stays attached to the answers, the survey isn't anonymous.
• Timing. If an administrator can see straight away who has taken part and straight away which answer came in, the two can be put side by side.
• Open answers. Someone who writes "since I came back after the accident" has already named themselves. Free text is never anonymous by default.
• Technical traces. IP addresses, device data and log files can be traceable even when the questionnaire isn't.

What the GDPR asks while data is traceable

Even a survey that ends up anonymous usually starts with personal data: a list of email addresses, invitations, reminders. And a confidential survey processes personal data from start to finish. For those steps, among other things:

A lawful basis (Article 6). Consent looks like the obvious choice, but rarely works in employment. The EDPB writes that it is unlikely an employee can refuse their employer without fear or real risk of detrimental effects, and that for most processing at work, consent cannot and should not be the lawful basis. An employer will therefore usually need another basis, such as legitimate interests, with a documented balancing of that interest against employees' privacy.

Transparency (Article 13). Tell people up front what you collect, why, who sees it, how long you keep it and which other parties are involved. That's also exactly what employees need in order to trust the survey.

Data minimisation. Only ask for characteristics you actually need for the analysis.

No special category data (Article 9). Health, ethnic origin, religion and sexual orientation are special categories of personal data that may only be processed under strict conditions. Don't ask about them in an employee survey.

A data processing agreement (Article 28). If you use an external platform, it acts as your processor, and you need written terms on what it may do with the data.

Retention periods. Agree how long you keep the data, and delete or anonymise it afterwards.

A DPIA (Article 35). Check whether a data protection impact assessment is required. For a large-scale survey on sensitive topics, it's more likely to be.

Works councils and employee representatives

Depending on the country, employee representatives may have a say in how employee data is processed. In the Netherlands, for example, the Works Councils Act gives the works council a right of consent over proposed arrangements for processing and protecting employees' personal data (Article 27(1)(k)), and over systems capable of monitoring employees' attendance, behaviour or performance (Article 27(1)(l)). Whether your survey falls under rules like these depends on the country and the set-up. But legal questions aside, a works council involved early, helping to think through anonymity, is the best ambassador a survey can have.

A checklist for a survey people trust

For setting up the questionnaire itself, see our employee survey questions, and for eNPS as a core question, What is eNPS?

How ScoreStory handles anonymity

We build ScoreStory for exactly this kind of research, so it's fair to ask what we actually do. When you make a survey anonymous:

• No names or email addresses with the conversations. Not even if a participant mentions themselves, and they can't be added afterwards.
• The link is deleted, not hidden. Once a conversation is finished, its reference to the invitation, and so to the email address, is removed from the database in the next round.
• Participation lags by 72 hours. You can see that someone took part, but it's updated once every 72 hours in a single round, with the same timestamp for everyone in that round. So you can't match an incoming conversation to whoever just finished.
• Small groups stay hidden. Filter on a characteristic that covers fewer than five participants and you won't see any results.
• Participants stay in control. At the end, each participant gets a deletion code to have their own conversation erased later. We don't keep the code itself, so only the participant can do this.
• The setting locks as soon as the first participant has taken part, so anonymity can't change halfway through.

And the limits, because there are some: if only one person is unlinked in a 72-hour round, that round still identifies them. A very short date filter can isolate a single conversation. And whatever someone types stays exactly as they typed it. With us, anonymous means: not traceable through the system.

The data is stored on servers in the Netherlands. For the conversation itself we currently use a language model from Anthropic, a US company; that transfer is covered by the EU Standard Contractual Clauses. Every party involved, and what they get to see, is listed in our privacy statement.