October 21, 2026

Co-Founder & CEO at Hrider

Are employee satisfaction surveys really anonymous?

What science says about employee privacy

An employee climate survey can be anonymous and yet still allow those who responded to be identified. Even if names are not collected, certain combinations of data, such as department, job position, or tenure, can indirectly reveal the identity of participants.

To protect anonymity in an employee climate survey, it is not enough to simply eliminate personally identifiable data. It is also necessary to control how responses are grouped, analyzed, and displayed.

One of the measures that helps reduce this risk is k-anonymity, a privacy principle that can be applied by setting a minimum number of participants to view the results of each group.

But ensuring privacy is not the only challenge. An employee climate assessment must also provide useful information to understand what is happening in the organization and to make informed decisions.

Scientific research allows us to understand why we need to combine three elements: protection of anonymity, flexibility in organizational analysis, and HR professionals prepared to interpret the data.

Can an employee be identified in an anonymous survey?

Imagine you work at a company and take part in an employee climate survey.

You are assured that your responses are anonymous, so you decide to honestly express your opinion about your manager, working conditions, and professional development opportunities.

However, when Human Resources analyzes the results, they can filter them by department, position, and tenure.

And it turns out you are the only person in your department who holds that position and has been with the organization for more than ten years.

Even if your name does not appear in any report, would it be difficult to deduce which responses are yours?

This example illustrates one of the major challenges of employee climate assessments: obtaining sufficiently detailed information to improve the organization without compromising employee privacy.

The problem of seemingly anonymous data

Researcher Latanya Sweeney addressed this issue in her scientific paper K-Anonymity: A Model for Protecting Privacy, published in 2002.

Her research explains how certain attributes that individually seem harmless can be combined to identify an individual.

For example, knowing someone's age, gender, and postal code can provide enough information to distinguish them within a population.

A similar thing happens in the workplace.

Knowing an employee's department might not allow them to be identified. Nor their job position or tenure. But what happens when we combine all three characteristics?

Consider a company with 300 employees. Even though its workforce is large, there might only be one person who meets all these conditions:

Works in the finance department.
Holds a managerial position.
Has more than 15 years of tenure.

If the results of an employee climate survey can be viewed by simultaneously applying those filters, the identity of the person who responded could be exposed.

The risk of identification depends not only on how many people work in a company, but also on how their responses are grouped and presented.

Therefore, guaranteeing privacy requires paying attention to both data collection and its subsequent analysis.

What is k-anonymity in an employee climate survey?

K-anonymity is a privacy protection model that seeks to prevent an individual from being individually distinguished within a dataset.

In its original formulation, proposed by Latanya Sweeney, it establishes that each record must be indistinguishable from at least k-1 other records regarding certain attributes that could allow identification.

In employee climate assessments, this principle can inspire a practical measure: setting a minimum number of participants for the results of a group to be displayed.

For example, if we set a minimum of five responses, results corresponding to groups that do not reach that number will remain hidden.

Imagine a company that conducts an employee climate survey and obtains the following participation results:

Department	Responses Received	Displayed with a minimum of 5?
Sales	18	Yes
Production	25	Yes
Administration	7	Yes
Marketing	3	No
Finance	2	No

In this example, the results for Marketing and Finance would not be displayed individually because their groups do not reach the established minimum.

In this way, the risk of a manager deducing what specific people answered is reduced.

It is worth distinguishing between the mathematical model of k-anonymity and the application of minimum participation thresholds in reports. They are related mechanisms, but setting a threshold alone does not guarantee compliance with the formal model nor does it eliminate all identification risks.

What happens when combining different filters?

The risk can increase when multiple employee characteristics are used simultaneously.

For example:

Department: Sales + Gender: Female + Tenure: over ten years.

Even if the sales department has 40 employees, perhaps only two people meet those conditions.

Therefore, it is not enough to verify that a department has enough participants. It is also important to consider the filter combinations used during analysis.

This is one of the reasons why anonymity protection measures should be considered right from the design of the assessment and not only when reports are published.

What does science say about anonymity in workplace surveys?

Privacy protection in organizational studies is not a recent concern.

Research exists that allows us to understand identification risks, the limits of anonymization measures, and the influence that anonymity can have on responses.

Here are some of the most relevant contributions:

Research	Main Contribution	HR Application
Sweeney (2002)	Removing identifiers does not always prevent individuals from being recognized.	Avoid segmentations that allow indirect identification.
Valantine et al. (2022)	The NIH set a minimum of 15 responses to provide aggregated results for a workplace climate survey.	Protect the results of small teams.
Cox (1980)	Hidden results can potentially be reconstructed using other published data.	Control comparisons between group aggregations.
Lelkes et al. (2012)	Complete anonymity does not always improve the accuracy of responses.	Interpret results thoughtfully and account for potential biases.

These studies address different issues, but they share an important lesson: the quality of an assessment depends not only on gathering responses, but also on how they are protected, processed, and interpreted.

A real case: how the NIH protected the anonymity of its employees

One of the most interesting examples comes from the National Institutes of Health (NIH), one of the leading biomedical research institutions in the United States.

In 2019, the NIH conducted a survey on workplace climate and harassment within their organization.

The methodology was later described in the article Ending Sexual Harassment in Science: Designing and Administering a Survey That Can Lead to an Improved Organizational Climate, published in 2022 in the scientific journal Academic Medicine.

The survey received 15,794 responses, with a participation rate of 44%.

One of the most relevant methodological decisions was setting a minimum of 15 responses to display results for each group.

Why?

Because certain organizational units were small and some combinations of demographic and professional characteristics could compromise participant confidentiality.

In addition, the NIH implemented other protective measures. The survey was administered by an external vendor, who was also responsible for data storage and analysis.

The institution did not have access to individual responses, only to aggregated results.

The study also acknowledged an important consequence: in some small units, the privacy threshold limited the analyses that could be conducted.

This case demonstrates that setting a minimum number of responses is a measure used in real-world organizational assessments, although it also highlights the need to find a balance between protection and information utility.

How many responses are necessary to protect anonymity?

There is no universal minimum number that guarantees anonymity in all employee climate assessments.

The appropriate value depends on several factors, such as the size of the organization, the sensitivity of the questions, participant characteristics, and segmentation possibilities.

For instance, analyzing overall employee satisfaction is not the same as conducting an assessment on workplace harassment, discrimination, or conflicts with managers.

Nor do a company with thousands of workers and numerous departments carry the same risks as a small organization where everyone knows the duties and circumstances of their peers.

Therefore, choosing the minimum number of participants must result from an evaluation of identification risks.

The NIH case, which established a minimum of 15 responses, is an example of practical application, but it does not mean that all organizations should use that exact same threshold.

The more detailed the analysis and the more sensitive the information, the greater the attention we must pay to protecting participants.

We must also consider that hiding the results of a small group does not always prevent them from being inferred.

When hidden results can be reconstructed

Imagine an organization with three departments:

Department	Responses
Sales	20
Administration	8
Executive / Management	2
Total	30

With a minimum of five responses, the Executive / Management results would remain hidden.

However, if we display certain statistics for the overall company and the other two departments, it might be possible to calculate the statistics corresponding to Executive / Management.

This problem relates to what is known in statistics as disclosure control.

Back in 1980, Lawrence H. Cox studied complementary data suppression techniques in his paper Suppression Methodology and Statistical Disclosure Control.

His work analyzes how to prevent certain hidden data from being mathematically reconstructed through the rest of the published information.

Although this research was not specifically developed for employee climate surveys, its principles are relevant for understanding the risks associated with publishing aggregated statistics.

This serves as a reminder that anonymity must be evaluated across the entire analysis system, taking into account filters, groupings, and relationships between different reports.

How to analyze the workplace climate of small departments without losing useful information?

Up to this point, the usefulness of establishing a minimum number of participants seems clear.

However, a problem arises.

What happens when a company has many small departments or teams?

Imagine an organization with the following structure:

Departments	Employees
Marketing	3
Finance	2
Administration	4
Sales	12
Operations	20

If we set a minimum of five participants, the first three departments could not display their results separately, even if all of their employees participated.

Does this mean Human Resources must give up understanding the workplace climate in those areas?

Not necessarily.

One solution is to create higher-level organizational groupings that allow results to be analyzed collectively.

For example, Marketing, Finance, and Administration could form part of a unit called "Corporate Services."

This new grouping would bring together nine people.

If the number of responses reaches the set minimum, we could analyze the aggregated climate for the area without needing to show individual results for its departments.

Thus, instead of losing that information completely, we gain a broader view that can help us identify opportunities for improvement.

Of course, not just any grouping is appropriate.

To correctly interpret the results, grouped teams should share relevant organizational characteristics. Combining completely different departments just to reach a numerical minimum could make it harder to understand their circumstances.

And this need raises an interesting question:

Why should employee climate assessments be limited by the administrative structure of the company?

How to combine flexible organizational structures and k-anonymity with Hrider

Organizations usually have a hierarchical structure defining departments, positions, and reporting lines.

This structure is necessary to manage numerous HR processes, but it is not always the most suitable for analyzing workplace climate.

A company might want to study how employees in a specific region, members of a cross-functional project, or those sharing similar working conditions perceive their work environment.

These groupings do not have to coincide with official departments.

In some general HR software, assessments depend on the organizational structure defined to manage headcount. When this structure is rigid, it can be difficult to create specific groupings for analyzing a particular evaluation.

In Hrider, the organizational structure is flexible and can adapt to the needs of each assessment.

The platform allows organizing people through a tree structure, creating different levels and logical groupings that do not necessarily mirror the official org chart.

For example, a company could analyze its employees from different perspectives:

Assessment Type	Useful Organizational Grouping
General workplace climate	Departments and functional areas
Workplace well-being	Shifts or groups with similar working conditions
Leadership	Teams reporting to specific managers
Organizational culture	Business units or major divisions
Employee experience	Workplaces or geographic zones

This flexibility allows the organization of participants to align with the goals of the assessment, rather than relying exclusively on the existing administrative structure.

A structure that adapts to what we need to analyze

Let us return to the example of small departments.

In Hrider we could create an organizational structure like this:

Executive Management

Corporate Services: 9 people.
- Marketing: 3 people.
- Finance: 2 people.
- Administration: 4 people.
Sales: 12 people.
Operations: 20 people.

If we configure a minimum of five participants, the results for Marketing, Finance, and Administration would not be displayed individually.

However, we could analyze the aggregated results for Corporate Services, as long as the number of responses meets the minimum threshold.

In this way, Human Resources can continue obtaining useful insights without having to display results from groupings that are too small.

More flexibility to analyze, more protection to respond

The inclusion of k-anonymity in Hrider allows defining the minimum number of people that a data section must include in order to display its results.

When a section does not reach the set minimum, its data is not displayed.

This feature is complemented by the ability to create flexible organizational structures for assessments.

On one hand, Human Resources can organize employees through groupings that make analytical sense.

On the other hand, the configured minimum sets a boundary on which results can be viewed.

This combination allows assessments to adapt to each organization's needs without compromising measures intended to protect participant identity.

However, flexibility also requires responsible management. Overlapping groupings, structural changes, and comparing different reports must be evaluated to prevent data from small groups from being indirectly inferred.

The true advantage is not showing more information at all costs, but having the necessary flexibility to analyze what matters while respecting employee privacy.

Is greater anonymity always better for response quality? Not necessarily

It is common to hear that anonymous surveys yield more honest responses.

The logic seems sound: if individuals know their opinions cannot be tied to their identity, they may feel more comfortable voicing criticisms or sharing sensitive experiences.

However, scientific research introduces an important nuance.

In 2012, Yphtach Lelkes and other researchers published the article Complete Anonymity Compromises the Accuracy of Self-Reports in the Journal of Experimental Social Psychology.

Through three studies with university students, they analyzed how complete anonymity influenced the accuracy of self-reported data.

The researchers observed that anonymity could encourage the disclosure of certain socially undesirable attitudes or behaviors.

However, they also found that participants who answered completely anonymously showed lower accuracy and a higher tendency to answer without sufficient reflection.

The authors proposed a possible explanation: although anonymity can reduce the desire to present a socially desirable image, it may also decrease the sense of accountability associated with answers.

These findings do not mean we should eliminate anonymity in workplace climate surveys.

The studies were not conducted in that specific setting, and their conclusions cannot be automatically transferred to all organizational assessments. Furthermore, full response anonymity and protecting aggregated results via a minimum threshold are different measures.

However, they do allow us to challenge an oversimplified belief:

More anonymity does not necessarily mean better data.

The quality of an assessment also depends on other factors, such as question clarity, participant motivation, response representativeness, and the context in which it takes place.

And above all, on what we do with the information obtained.

A survey can adequately protect participant identity and still produce results that are difficult to interpret or lead to wrong decisions if not analyzed correctly.

Therefore, we must distinguish two objectives that complement each other, but are not equivalent:

Protect privacy: reduce the risk that responses can be attributed to specific individuals.

Ensure analytical quality: obtain valid, contextualized, and sufficiently reliable information to guide decision-making.

Both are essential for an employee climate assessment to be useful.

And this leads us to the fundamental role of Human Resources professionals.

Why are Human Resources professionals key to interpreting a climate survey?

Technology has transformed our ability to gather, organize, and analyze information about people.

Today we can run climate assessments, identify differences between teams, compare results, and detect trends far more easily than a few years ago.

However, having more data does not necessarily mean better understanding what is happening in an organization.

Imagine a survey reveals that the sales department shows a significantly lower satisfaction level compared to the rest of the company.

What does that result mean?

Is there a leadership issue? Have working conditions changed? Is workload increasing? Is an organizational transformation taking place? Or are the results skewed by very low participation?

A report can help us identify a discrepancy, but not necessarily explain its root causes.

To understand what is happening, we need to know the context, formulate hypotheses, cross-reference information, and consider alternative explanations.

This is where the role of Human Resources professionals becomes indispensable.

Their understanding of the organization, labor relations, and team dynamics is essential to interpreting results thoughtfully.

K-anonymity can help protect responses. A flexible organizational structure can facilitate analysis. But neither of these features replaces the professional judgment needed to understand data and decide how to act.

And this brings us to another key topic: the importance of developing skills in People Analytics.

People Analytics: learning to interpret data before making decisions

People Analytics involves using data, analytical methods, and evidence to better understand people-related phenomena and support decision-making in organizations.

However, applying People Analytics does not mean simply generating charts, calculating metrics, or using tech tools.

It also requires developing a critical perspective on information.

For example, when analyzing the results of a climate survey, we should ask ourselves questions like:

Who participated?

A department might show an excellent score, but if only a small fraction of its employees responded, we should interpret the results with caution.

Are we comparing equivalent groups?

Differences between teams may stem from factors related to their working conditions, job roles, or team composition.

Are the observed differences meaningful?

A difference of a few decimal points between two departments does not always represent a statistically significant difference or a meaningful distinction from an organizational standpoint.

Can we establish cause-and-effect relationships?

The fact that a team shows low satisfaction and high turnover does not automatically prove that one variable is the cause of the other.

Are we adequately protecting privacy?

In addition to meeting participation minimums, we must avoid interpretations or data combinations that allow employees to be indirectly identified.

These questions demonstrate why People Analytics training should be part of the professional development of those working in Human Resources.

It is not about turning every HR professional into a data scientist.

It is about acquiring knowledge to understand concepts such as representativeness, bias, correlation, variability, and data quality.

It is also about knowing when a conclusion is sufficiently supported and when further investigation is needed before taking action.

The importance of combining data and human insight

Let us go back to the example of a department with negative results in its climate assessment.

A quantitative analysis might reveal that employees feel a lack of recognition.

However, understanding why that happens requires more.

Perhaps the organization recently changed its incentive system. Maybe managers have not received leadership training. Or employees might be experiencing workload burnout that isn't directly captured in the survey questions.

HR professionals can leverage their organizational knowledge to formulate these hypotheses and determine how to test them.

For instance, through conversations with managers, interviews, focus groups, or supplementary assessments, always respecting participant confidentiality.

They can also identify which actions are most suitable and subsequently evaluate whether they produced improvements.

In this sense, the value of People Analytics lies not solely in analyzing the past, but in transforming available information into well-founded decisions and actions that improve employee experience.

Technological tools expand our capabilities, but it is people who must decide which questions are worth investigating, how to interpret the answers, and what to do with the results.

Five principles for analyzing workplace climate while protecting privacy

Research on anonymity and the use of evaluation tools allow identifying five principles that can help organizations conduct useful and responsible analyses.

Principle	What does it consist of?	Why is it important?
1. Protect identity	Prevent participants from being recognized through direct or indirect data.	Reduces identification risks.
2. Set minimum thresholds	Do not show results for groupings that fail to reach the defined minimum participant count.	Especially protects small teams.
3. Adapt groupings	Organize employees into units that make sense for each assessment.	Allows obtaining useful information without relying on rigid structures.
4. Interpret results with rigor	Account for participation rates, bias, context, and statistical limitations.	Prevents drawing poorly supported conclusions.
5. Turn data into action	Use results to design, implement, and evaluate improvements.	Transforms the assessment into a management tool.

These principles are not a single technical standard, but a synthesis of best practices applicable to workplace climate assessments.

Their goal is to strike a balance between three needs: listening to employees, protecting their opinions, and obtaining information that enables organizational improvement.

Protecting anonymity also means building trust

There is another fundamental aspect we must not forget.

A workplace climate survey is not merely a data collection process. It is also a channel of communication between the organization and its employees.

When a company asks for its workers' feedback, it conveys that their experience matters and that it wants to listen.

However, that invitation must be accompanied by guarantees.

Participants need to understand how their answers will be used, who will have access to the results, and what measures exist to protect their privacy.

In this context, features like k-anonymity allow setting concrete boundaries on the information that can be accessed.

However, trust is not built solely through technical mechanisms.

It also depends on the transparency with which the assessment is communicated, management behavior, and especially what happens afterward.

If employees participate in survey after survey and never see results or follow-up improvements, they may end up questioning the process's value.

Conversely, when HR shares key takeaways, explains decisions made, and tracks initiatives, the assessment can become a tool for dialogue and continuous improvement.

Protecting the identity of respondents is important. Demonstrating that their feedback leads to real organizational improvements is equally vital.

Frequently asked questions about anonymity in workplace climate surveys

Are workplace climate surveys truly anonymous?

They can be designed to protect anonymity, but it is also necessary to prevent individuals from being identified through combinations of traits like department, position, age, or tenure.

Protection must encompass data collection as well as its subsequent analysis and presentation.

What is k-anonymity in Human Resources?

K-anonymity is a privacy principle aimed at preventing an individual from being uniquely distinguished within a dataset.

In HR assessments, it can inspire mechanisms that establish a minimum number of participants required to display group results.

If that minimum is not reached, results remain hidden.

What is the recommended minimum number of responses to guarantee anonymity?

There is no single universal minimum number that guarantees anonymity in every situation.

The choice depends on company size, question sensitivity, and the possibility of indirectly identifying participants.

For example, the National Institutes of Health used a minimum of 15 responses to present aggregated results for a workplace climate and harassment survey.

How to analyze the workplace climate of small departments?

One option is creating higher-level organizational groupings that combine several small teams.

This way, HR can analyze aggregated results without displaying the opinions of groups that fall below the set participation threshold.

It is important that these groupings make organizational sense and that cross-report comparisons do not allow hidden results to be reconstructed.

Does anonymity make employees respond more honestly?

Anonymity can reduce fear of expressing certain opinions, especially when addressing sensitive issues.

However, scientific research indicates that full anonymity does not necessarily guarantee greater response accuracy.

Survey quality also depends on survey design, participant motivation, and proper result interpretation.

What is the relationship between anonymity and People Analytics?

Anonymity helps protect participant identity in evaluations.

People Analytics, on the other hand, provides methods to analyze results, identify biases, interpret differences, and make informed decisions.

Both are essential: we need protected data, but also professionals capable of understanding its limits and using it responsibly.

How does Hrider help protect anonymity in assessments?

Hrider incorporates a k-anonymity feature that allows setting the minimum number of people required in a data section to display its results.

Furthermore, its flexible organizational structure enables creating employee groupings tailored to the objectives of each assessment.

This combination facilitates workplace climate analysis through logical groupings while maintaining display limits designed to protect participant privacy.

The future of workplace climate assessments: privacy, flexibility, and professional judgment

Workplace climate assessments have evolved far beyond once-a-year questionnaires.

Today, organizations need insights that allow them to understand employee experiences, detect issues, and act swiftly.

However, this analytical capability brings new challenges.

The greater the ability to segment results, the greater the need to pay attention to privacy.

And the more data we have available, the more important it becomes to have professionals capable of interpreting it correctly.

The integration of k-anonymity in Hrider, alongside the ability to build flexible organizational structures, addresses a key part of this challenge.

On one hand, it allows tailoring employee groupings to each assessment's goals without being constrained by a rigid organigram.

On the other, it sets a participant minimum to view results, reducing exposure risks for small groups.

However, data protection tools and organizational analysis only reach their full potential when used thoughtfully.

That is why developing People Analytics skills and leveraging HR professional expertise are just as critical as the technology itself.

Because the ultimate goal of a workplace climate survey should not be to gather the maximum number of indicators or generate increasingly granular reports.

It should be to better understand employee experiences within the organization and use that insight to make decisions that improve their work life.

To achieve this, we need three ingredients: privacy-protecting technology, actionable data analysis, and professionals who interpret results rigorously.

In the end, a good workplace climate survey is not the one that collects the most data.

It is the one that successfully transforms people's feedback into real improvements without compromising their trust.

Scientific References

Sweeney, L. (2002). K-Anonymity: A Model for Protecting Privacy. International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, 10(5), 557-570.

Valantine, H. A., Le Fauve, C. E., Morris, K. A., & Riley, W. T. (2022). Ending Sexual Harassment in Science: Designing and Administering a Survey That Can Lead to an Improved Organizational Climate. Academic Medicine, 97(3), 364-369.

Lelkes, Y., Krosnick, J. A., Marx, D. M., Judd, C. M., & Park, B. (2012). Complete Anonymity Compromises the Accuracy of Self-Reports. Journal of Experimental Social Psychology, 48(6), 1291-1299.

Cox, L. H. (1980). Suppression Methodology and Statistical Disclosure Control. Journal of the American Statistical Association, 75(370), 377-385.

Subscribe to
our Blog

Digitize talent management with Hrider. Try it for free today with no time limit!