Employee survey anonymity: the five-person threshold

Most employee surveys are confidential rather than truly anonymous. The survey tool usually knows who was invited and who answered, and the protection comes from what the employer is shown: results only for groups of at least five people, filters that can’t narrow below that, and comments with names removed. If those rules are set up well, the employer can’t see what any one person said. If they’re set up badly, small groups and free text can give people away.

Are anonymous employee surveys really anonymous to the employer?

It depends on what “anonymous” means in the invitation. In everyday use it means “your manager won’t know it was you”. In a strict sense it means nobody, including the survey provider, can link an answer to a person. Very few workplace surveys meet the strict sense.

There are good reasons for that. To send each person a personal link, chase non-responders and break results down by department, the tool needs to know who belongs where. A truly anonymous survey, such as one open link posted on the intranet, can’t do any of that, and it also can’t stop one person from answering ten times.

So the useful question for an employee is: what does my employer get to see? And the useful question for HR is: what are we promising, and can we keep that promise?

What is the difference between anonymous and confidential surveys?

An anonymous survey collects no identity at all. Nobody, including the provider, can tell who answered.

A confidential survey knows who took part but keeps that link away from the employer. Responses are reported only in groups, and the provider holds the identity data under contract.

Most engagement platforms run confidential surveys by default. Microsoft Viva Glint, for example, describes its standard surveys as confidential and separates them from identifiable lifecycle surveys where the threshold is lower. If your invitation says “anonymous” and the tool is really confidential, change the wording. People notice, and it costs you trust you will need later.

Why is the minimum group size usually five?

A reporting threshold is the smallest number of responses a group needs before the tool shows its results. Below it, the group’s scores and comments are hidden.

Five is the common default. Viva Glint’s default threshold for showing scores is five responses, and it can be lowered to three; its default for showing comments is higher, at ten. Culture Amp calls this the reporting group minimum, the smallest group you can filter down to, and lets each organisation set its own number, with a separate minimum for comments. Qualtrics lets dashboard owners set a threshold and mark how sensitive each filter field is, so values below the threshold can’t be picked.

Why five? With two or three people, a manager who knows the team can often guess who gave which answer. With five or more, an average or a theme describes the group, and no single answer stands out. Five is a convention. For sensitive topics, such as harassment or mental health, you can set it higher.

How can people be re-identified from small groups?

Even with a threshold, there are three common leaks.

Subtraction. Suppose the finance department has 22 responses and is shown. The accounts payable team within it has 4 and is hidden. If the report also shows finance minus accounts payable, anyone can work out the hidden team’s average. Culture Amp’s help pages describe exactly this kind of indirect identification, and Viva Glint deals with it by also hiding the next group up, so the gap can’t be calculated.

Stacked filters. Each filter on its own may leave a group of twenty. Combine site, gender, age band and length of service, and you can end up with one person: the only woman over fifty on the night shift at the Leeds depot. A good tool checks the group size again each time another filter is added.

Free text. Comments are the biggest risk. People mention their manager by name, their exact role, a specific incident, or write in a recognisable way. “Since I came back from maternity leave in March” narrows things fast in a team of twelve. This is why several tools set a higher threshold for comments than for scores.

What should a good survey or interview tool do?

At a minimum, check that your tool does the following:

• Hides every result, score and comment for any group under the threshold.
• Blocks filters and combinations of filters that would narrow a view below the threshold.
• Prevents subtraction, by also hiding a neighbouring group when one is suppressed.
• Removes names and other personal details from quoted text before it reaches a report.
• Fixes the threshold before the survey starts, so nobody can lower it once answers are in. Viva Glint, for example, locks survey-level thresholds once a programme has collected responses.
• Shows people, before they start, who will see what.

Spradley runs one-on-one AI interviews, which produce more free text than a survey, so these rules matter even more. Spradley knows who was invited so it can send each person their own link, which makes it confidential rather than anonymous. Names and personal details are removed from the text that reports and quotes use, and numbers and ratings are never shown for fewer than five people. Our HR and people page explains how that fits into a listening programme.

What should the employer promise, and what not?

Promise what the system enforces. Good examples:

• “Your manager will not see your individual answers.”
• “Results are only shown for groups of five or more.”
• “Quotes are shown without names, and we remove details that point to you.”
• “Taking part is voluntary, and you can skip any question.”

Don’t promise what you can’t control:

• “Completely anonymous”, if the tool knows who was invited.
• “No one can ever work out who said this”, because a determined colleague reading a vivid comment sometimes can.
• “We will never follow up”, if your policy says serious allegations such as harassment or safety risks must be acted on.

That last point deserves a plan. Decide before launch what happens if someone describes a safety risk or abuse in a comment. Usually the answer is that the provider doesn’t pass on identities, and the organisation points people to a proper reporting channel instead. Say so in the invitation.

It also helps to tell people how to protect themselves: describe the problem without naming people, and leave out details that only you would know. It sounds obvious. People still appreciate being told.

Does the threshold matter for small teams?

Yes, and it cuts both ways. In a team of six, a threshold of five means you only get results if nearly everyone answers. Merge small teams into a larger reporting group, such as the whole site or function, rather than lowering the threshold. A ward of four nurses can be reported together with the next ward. You lose some detail, and you keep the trust that gets you honest answers next time.

Trust is what all of this is for. Questions about psychological safety or a bad manager only get honest answers if people believe the protections hold. If you plan to use interviews alongside or instead of a survey, our comparison of AI-moderated interviews and surveys covers what changes, and our guide to works councils and GDPR covers what to agree before launch.

Frequently asked questions

Key terms

anonymous survey

A survey that collects no identity at all, so nobody, including the provider, can tell who answered.

confidential survey

A survey where the provider knows who took part but the employer sees results only for groups, never linked to individuals. Most employee surveys work this way.

minimum group size

The smallest number of responses a group needs before its results are shown. Five is a common default; smaller groups are hidden or combined with a larger one.

indirect identification

Working out a person’s or a hidden group’s answers from what is shown, for example by subtracting one group from a larger one or stacking several filters.

free text

Answers written in people’s own words. They are the main re-identification risk, because they can mention names, roles or specific incidents.