How to run an anonymous employee survey people can trust

An employee survey is only anonymous if the people who receive the results cannot reasonably work out who gave an answer. Removing names helps, but a small team, a distinctive comment or a combination of demographic filters can still identify someone.

You can reduce these risks with any survey tool. The work starts before you send the invitation and continues through reporting, exports and the conversations managers have afterwards. This guide explains what to check, what to tell employees and where a purpose-built platform can take work off your hands.

Are employee surveys really anonymous?

Some are. Others collect identifiable responses and restrict who can see them. Others remove names from the dashboard while leaving enough detail to recognise the person behind an answer.

The useful question is: anonymous to whom? A line manager, an HR administrator and the survey provider may have very different access. A survey can protect someone’s identity in a manager’s report while the provider still holds account or participation data.

Ask what is collected, who can access it and whether responses can be connected to people. Then check whether the settings, exports and reporting rules deliver the promise you intend to make.

Anonymous, confidential and pseudonymous mean different things

A pseudonym is useful protection, but it is not proof that the underlying data is anonymous. The UK Information Commissioner’s Office explains that identification can happen through linking information or singling someone out, even without their name. Its anonymisation guidance is a useful way to think about that risk.

Why employees doubt the promise

An employee does not need to understand your survey settings to spot a problem. They know they are the only new starter in their office, or the only person who raised a particular issue last week.

In a Reddit discussion about Microsoft Forms, an employee questioned whether a survey requiring a work login could be anonymous. Replies disagreed about what administrators could see. The uncertainty itself is useful: employees need a clear explanation of the actual setup, rather than reassurance based on the tool’s name.

Your staff have the same questions: could someone recognise me, and what will happen if they do?

Software cannot answer the second question alone. If managers hunt for the author of criticism, or staff never hear what changed, another reassurance about anonymity is unlikely to help.

How to make an employee survey anonymous with any tool

1. Decide what you can honestly promise

Write down the full path from an employee opening the survey to a manager reading the report. Include the survey provider, internal administrators, connected spreadsheets and any AI service used to analyse comments.

For each person or system, record what it can see. Separate the ability to send an invitation or reminder from the ability to connect a response to a person.

If an administrator can recover that connection, describe the underlying collection as confidential or pseudonymous, even if managers receive anonymised results. Explain the distinction in ordinary language.

2. Collect less information

Every demographic question should have a reporting purpose. Remove fields you will not use, and avoid precise categories when broader ones would answer the business question.

“Tenure: less than one year” reveals less than an exact start date. A regional grouping may be enough instead of an office with two staff. For optional demographic questions, offer a way to decline without losing the rest of the response.

Review combinations as well as individual fields. Department, location, job level and tenure might each look harmless. Together, they can describe one person.

Do not collect contact details in the survey just because someone might want a follow-up. Offer a separate contact route that does not carry their survey answers into it.

3. Check collection settings, not just the title

A form called “Anonymous feedback” can still collect identifying information. Check the tool’s settings for email addresses, sign-in, personal invitation links, hidden fields, IP addresses, timestamps and integrations.

A personalised link is not, by itself, proof that an employer can read an identified answer. Equally, a public link is not proof of anonymity. What matters is what the system records and what each role can retrieve.

Two examples show why the details matter:

• Google Forms: Google says limiting a form to one response requires sign-in, but usernames are not recorded unless email collection is enabled. It also warns that sharing response summaries can expose full-text answers to respondents. Check both collection and results-sharing settings. Google’s guidance
• SurveyMonkey: Anonymous Responses must be enabled for each collector. Its guidance distinguishes information excluded from survey results from IP addresses retained in backend logs. Read the settings for your invitation method. SurveyMonkey’s guidance

Run a test through the same invitation method employees will use. Inspect the stored response, download an export and open it as each relevant role. A preview of the survey questions will not show these risks.

4. Set a reporting threshold, then test its limits

A reporting threshold prevents results appearing for a group with too few responses. Set it before launch and explain what will happen when a team falls below it: for example, results may roll into a larger department.

Count responses, rather than invitations, when deciding whether a report is safe to release. Check scores, comments and filtered reports separately.

At Hoogly, we require at least five responses to be aggregated before team results appear. Inviting eight people is not enough if only four respond. This minimum works alongside anonymisation and role-based access, rather than replacing them. Read our anonymity and reporting documentation

Five responses can be a useful minimum, but it cannot guarantee anonymity. One unusually specific comment can identify someone in a much larger group. A sensitive question or distinctive team may need broader reporting or no breakdown at all.

Also test whether overlapping reports reveal a hidden result. If a manager can see the combined score for six people and a separate score for five of them, subtraction may reveal the sixth person’s answer. Ask your provider how it handles this; in a spreadsheet, you must prevent those combinations yourself.

5. Review every free-text answer before managers see it

Any free-text field shared with managers without review and summarisation can expose identifying information. This applies to every question with a written answer, not just a final comments box. Even an innocuous question such as “What would make your working day easier?” can prompt an unexpected story about a medical appointment, a dispute or a shift that only one person worked.

Names are only the obvious part. A project, incident, shift pattern or personal circumstance can be enough for a manager to recognise the writer. Removing names does not remove those clues.

For example, this fictional comment identifies a very specific situation:

“Since I moved from the Perth office in February, I’ve been the only person covering the Friday night handover.”

A safer summary could be:

“Staff raised concerns about handover coverage and workload following office changes.”

That summary removes the individual’s circumstances while preserving the issue leaders need to address. It also loses detail, so the person reviewing comments must check that the meaning remains accurate.

If you do not have a trusted system for managing this, a designated reviewer must manually read every free-text response before managers receive it. Review all written fields across the survey, including answers to seemingly harmless questions. Restrict raw responses to the people doing that review; managers should receive summaries with identifying details removed.

Read each answer in the context of what its manager already knows. Check combinations of details as well as individual phrases, then check that the summary preserves the meaning without pointing back to the person. Do not spot-check a sample or rely on employees to disguise their writing.

At Hoogly, we remove identifying details and summarise feedback within the conversation workflow, and employees can review their feedback before submitting it. This eliminates manual handling and summarisation, removing the risk of someone overlooking identifying details during manual review. Ad hoc, vibe-coded tools or Claude and ChatGPT summaries of survey results can miss those details. Employees know HR will never see their raw, cleartext answers: we share summarised, aggregated insights. That clear boundary builds trust before anyone answers a question. See how we protect your feedback during a conversation

Do not paste raw survey responses into a personal AI account or an unapproved tool. This includes employees using their own ChatGPT, Claude or other AI accounts to help with analysis: often called grey IT or shadow AI. A cleartext survey export can contain deeply personal information about health, family circumstances, grievances and colleagues. Uploading it sends those details to another service before anything has been anonymised. Asking for an anonymous summary afterwards does not undo that disclosure.

Be explicit with everyone handling responses: no personal AI accounts, browser extensions or ad hoc analysis tools for raw survey data. Use only systems approved for this specific data and purpose, with access, retention and data-use terms checked. The OAIC recommends keeping personal and sensitive information out of publicly available generative AI tools.

For approved AI-assisted analysis, check the output for missed clues and changes in meaning. An instruction to “anonymise this” does not establish that it has done so.

6. Limit access and control exports

Decide who needs raw responses, who needs an anonymised analysis and who only needs the resulting actions. Give each group the minimum access required.

Check download permissions and connected systems. A protected dashboard is little help if a broad group can open the linked spreadsheet or a raw export can be emailed to every manager.

Set retention rules for raw responses, exports and working copies. Document how access is removed when a survey administrator changes role. Include the provider’s support access and retention arrangements in your questions, rather than assuming that only your own staff can access information.

7. Explain the rules before asking for honesty

Employees should not have to search a long privacy policy to find out what their manager will see. Put a short explanation beside the invitation and provide a contact for questions.

Cover who can see individual responses, the minimum reporting group, how comments are handled and whether completion is tracked separately from answers. Explain what happens to sensitive disclosures and which separate routes people can use when they need individual help.

Here is wording to adapt after checking that it matches your setup:

We want to understand what is working and what needs to change.

Your manager will receive grouped results, not a report of your individual answers. Results will only be shared for groups with at least [number] responses. Smaller groups will [explain what happens].

Comments will be [summarised or reviewed] to remove details that could identify someone before they are shared. [Explain who can access the original responses, if anyone.]

[Explain whether we track survey completion and how that information is separated from answers.]

Please avoid including names or details that identify you or someone else. For an issue needing a personal response, use [separate contact route].

We will share the main findings by [date] and tell you what we will act on. Questions about privacy can go to [contact].

Avoid a promise such as “nobody can ever identify you” when you cannot support it. Clear limits are more credible than an absolute assurance that employees can immediately question.

8. Prepare managers for the results

Tell managers what responsible follow-up looks like before they receive a report. They should discuss the issue, invite suggestions and agree actions without asking anyone to identify themselves.

A constructive response is: “Workload came up as a concern. Which priorities should we review?” Asking “Who wrote that?” or suggesting a likely author undermines the protection you have put in place.

Managers should not pressure a small team to prove they completed the survey or ask someone to explain an answer they suspect is theirs. Give staff a clear route to report that behaviour.

9. Show what changed

Set a date for sharing findings and another for reviewing actions. Explain what you heard, what you will do and what you cannot change yet.

Be specific enough for staff to recognise the connection. “We heard that handovers are understaffed, so we are changing coverage” is more useful than “We remain committed to listening.”

Protect anonymity in these updates too. Avoid retelling the incident that made a comment identifiable in the first place.

Why follow-up focus groups can put anonymity at risk

Survey answers often leave HR with too little to act on. A low score or a comment like “communication is poor” tells you there is a problem, but gives you little detail about what happened or what would help. That can mean another round of focus groups, with all the recruitment, diary chasing and facilitation HR has to organise.

Those conversations also change the anonymity promise. In a focus group, colleagues and the facilitator can see who is speaking. Asking someone to explain their original comment can connect an anonymous answer to a name, while a distinctive example may reveal who raised the issue even if nobody asks directly. A confidential discussion is not the same as an anonymous survey response.

With Hoogly, we can follow up directly with the person who gave an answer without revealing their identity to their employer. We retain the connection between a contributor and their feedback so the conversation can continue, without sharing that connection with HR or managers. We can ask for the missing context without making someone repeat their concern in front of colleagues. This protects their identity in the follow-up; it does not mean we hold no personal data.

What Hoogly makes easier

With a general survey tool, someone has to maintain the settings, inspect exports, redact comments and check every reporting cut. At Hoogly, we bring several of those protections into the feedback workflow.

Employees speak or type with Venn, our AI interviewer, and can review their feedback before submitting it. We combine AI-assisted removal of identifying details, pseudonyms and aggregated reporting, with a five-response minimum before team results appear. Access to reporting is governed by roles. These controls reduce the amount of manual handling HR needs to organise. Managers receive feedback about their own leadership, while authorised senior leaders can understand how individual managers are performing; the anonymity protection applies to the employees giving that feedback. Read who can access our reporting and insights

As one of our customers put it, “the sense of real anonymity is there.” That feeling matters: staff decide what to share based on the experience they have, as well as the explanation they receive.

The same checks still apply. A threshold does not remove every risk in a small team, and no platform can make managers respond well to criticism. Ask us to demonstrate the employee view, the manager view and what happens below the reporting threshold using your own team structure.

We also process account and employment information to run Hoogly. Anonymised reporting should not be confused with a claim that the platform holds no personal data. Our privacy policy explains that distinction.

See how we work, or ask us to show how reporting works for your team.

Common questions about anonymous employee surveys

Can my employer tell who answered an anonymous survey?

It depends on the tool, configuration and access rights. An employer may be able to see who completed a survey without seeing their answers, or an administrator may have access to identifiable responses. Ask about those separately. Even without a technical connection, detailed comments or small reporting groups may reveal someone.

Does signing in mean a survey is not anonymous?

Not necessarily. Sign-in can be used to control participation without recording an account name against the answers shown to the survey owner. Check the provider’s explanation and test the configuration. Do not infer anonymity from the presence or absence of a login screen alone.

Is a team of five large enough?

Not automatically. Five is a reporting rule used by some platforms, including Hoogly, rather than a guarantee that nobody can be identified. Consider how distinctive the answers are, which filters are available and what other information a recipient already knows.

Can an anonymous survey ask which department I work in?

Yes, but department information increases identification risk when combined with other details. Collect it only if needed, suppress small groups and check combinations before reporting. For some teams, organisation-level findings will be safer than a departmental breakdown.

Are managers anonymous in employee surveys?

Distinguish the person giving feedback from the person it concerns. A manager answering a survey about their own experience should receive the protections described for that survey. A manager being assessed by their team may remain identifiable.

In Hoogly, the manager being discussed is not anonymous. Team feedback is associated with that manager so they receive specific guidance, and authorised senior leadership can understand how individual leaders are performing. Employees’ identities remain protected in the aggregated feedback. This allows accountability for leadership without identifying the people who raised an issue.

How do I run an anonymous Typeform survey?

Leave out name, email and other identifying questions. Check Workflow → Pull data in for URL parameters, formerly called Hidden Fields: Typeform can pass a person’s name or email into results through the survey link without asking them a question. Remove identifying parameters from the setup and the links you distribute, then check connected tools and exports using a test response. Typeform’s URL parameter guidance

You still need a process for grouping results and reviewing comments before sharing them with managers.

How do I run an anonymous Google Forms survey?

Turn off Collect email addresses, remove identifying questions and keep View results summary off so respondents cannot read everyone’s free-text answers. If you enable Limit to 1 response, Google requires sign-in but says usernames are not recorded unless email collection is enabled. Check the response sheet and sharing permissions with a test submission before launch. Google Forms settings guidance

Group the results and review identifying comments yourself before sending them to managers.

How do I run an anonymous SurveyMonkey survey?

Turn on Anonymous Responses for every collector you use. For email invitations, choose the option to exclude all respondent information from results; remove identifying questions, custom data and variables too. Check separately if an integration creates the collector, because its settings may govern anonymity. SurveyMonkey says Respondent Authentication tracks SSO profile information and is incompatible with anonymous collection. SurveyMonkey’s anonymity guidance

This controls information in survey results; it does not mean the provider holds no technical logs. Test the collector and export before inviting employees.

How do I run an anonymous Microsoft Forms survey?

For an internal form, use the appropriate organisation-only audience and clear Record name in settings. If Anyone can respond is appropriate, that allows submissions from outside your organisation too. Remove identifying questions and inspect the Excel export, sharing permissions and connected workflows with a test response. Organisation-only options depend on your account type. Microsoft Forms settings guidance

Keeping names out of the response report still leaves you responsible for small groups and identifying comments.

Can AI make employee comments anonymous?

AI can help remove identifying details or summarise comments, but it can miss context or change meaning. Assess what goes into the service, who can access it and what comes out. The full process matters more than whether the tool has an AI feature.

What should we do if someone reports a serious concern?

Plan this before launch. Explain which issues need a separate confidential reporting route, who handles them and any limits to the survey’s anonymity promise. Do not turn a general survey into an undisclosed investigation or imply it can provide an individual response when identities are unavailable.