Anonymous survey
What is an anonymous survey?
An anonymous survey collects no information capable of identifying a respondent, and stores no link between a person and an answer. Because no link exists, nobody can restore one, including the survey owner. An anonymous survey is therefore different from a confidential survey, where the link exists and is withheld by agreement. The distinction also decides which law applies. Recital 26 of the GDPR says the principles of data protection "should therefore not apply to anonymous information", meaning information that does not relate to an identified or identifiable person (GDPR, recital 26).
How does a survey become anonymous?
By removing the link, not by promising not to look at it. That means no name, no staff number, no email address, no device identifier and no individual invitation token tied to a person. It also means reporting results only for groups large enough that no single answer can be reconstructed. A team of 4 employees, filtered by role and location, is not anonymous whatever the survey tool says. Small-group reporting is where many anonymity promises break, so set the threshold before the survey opens. Gallup describes a minimum of five or more responses before reporting as typical (Gallup, Employee Surveys), and the survey in the 2017 German court case below promised no conclusions about groups of fewer than ten. Whichever floor you pick, publish it.
What is the difference between a confidential survey and an anonymous survey?
The difference is whether the link exists at all. In a confidential survey the answers are identifiable and somebody holds the key. That person undertakes not to share it with the employer. The employer sees totals. The provider sees names. In an anonymous survey the key was never created. There is nothing to hold and nothing to hand over under pressure. That distinction has a legal edge as well as a trust edge. Data that identifies nobody sits outside data-protection law. The UK regulator devotes a full guidance set to what does and does not count, and warns that effective anonymisation has to survive attempts to re-identify people (ICO, anonymisation guidance). Confidential data is still personal data, with all the duties that follow. In practice, a confidential survey lets you follow up with a person and track the same respondent over time. An anonymous survey buys you candour instead. You cannot have both from one questionnaire, and pretending otherwise is the thing employees notice first.
Why do people not believe the promise?
Because the promise is usually made by the party that benefits from the answers. Gallup, which has run this instrument commercially for decades, describes the consequence directly:
"When employees don't believe their input is truly anonymous, response rates drop and the data become less reliable." (Gallup, Employee Surveys)
Gallup also notes: "Employee surveys are often anonymous. What truly matters is whether employees believe their responses are confidential and used responsibly." The practical fix is to publish the mechanics before the survey opens. Say who runs it, what is stored, what the minimum group size for reporting is, and what happens to free-text comments, which are the hardest part of any anonymity claim because people identify themselves in them without meaning to.
In Germany there is a second reason to write this down. Personnel questionnaires (Personalfragebogen) need the works council's agreement under §94 Abs. 1 Satz 1 BetrVG: "Personalfragebogen bedürfen der Zustimmung des Betriebsrats" (personnel questionnaires require the works council's consent). Whether an employee survey counts as one depends on how it is built. The Federal Labour Court held in 2017 that a subsidiary's works council had no say over a group-wide survey, because the parent company ran it, and that the questionnaire was not a personnel questionnaire in any case, because taking part was strictly voluntary (BAG, 21 November 2017, 1 ABR 47/16). Agreeing the question set early is cheaper than arguing about it afterwards.
How does tchop handle anonymous feedback?
tchop runs one-question polls inside the employee app, and an editor can set a poll to anonymous voting before it is published, so the result shows counts or percentages per answer rather than names. By the definition on this page that makes the poll confidential rather than anonymous: the platform still records who voted, which is how it stops anyone voting twice. Where the votes are stored is checkable too: tchop runs on servers in Germany, on AWS or Hetzner by customer choice. tchop is not an engagement survey platform, so a benchmarked annual index still belongs with a specialist provider, and tchop does not produce one.
See how the employee app is used day to day.
FAQs: anonymous survey
What is the difference between anonymous and confidential data in surveys?
Anonymous data carries nothing that identifies a person and no key exists anywhere. Confidential data is identifiable and the identity is held by one party who agrees not to disclose it. Only the first is outside data-protection law, because the second is still personal data.
Are anonymous surveys from HR really anonymous?
Sometimes, and the answer is checkable rather than a matter of trust. Ask three questions:
Is there an individual invitation link?
What is the minimum group size used in reporting?
Who can read the free-text comments?
If the answers are no link, a stated group size and a named party, the claim holds. If any answer is vague, treat the survey as confidential at best.
Can an anonymous survey be traced?
Not if it was built properly, and often if it was not. The routes back are individual invitation tokens, device or network identifiers, timestamps combined with a small team, and free-text comments that describe a situation only one person is in. The last of these is the hardest to engineer away.
How can you tell if a survey is anonymous?
Read the invitation. A personalised link addressed to you by name is the clearest sign that it is not, because the link itself is the key. Then read the privacy note for the reporting threshold. A survey that will report a group of 3 employees as its own line, or that states no floor at all, is not anonymous, however it is labelled.
How do you reach staff who have no work account with a survey?
Through the phone they already carry, because a work email address will not reach them. Across the EU 64.6% of people employed in enterprises with 10 or more staff have internet access for business purposes, and in German food, beverage and tobacco manufacturing the share is 39.2% (Eurostat, isoc_ci_cm_pn2, 2025). Timing matters as much as the channel, since 9.3% of 42.6 million employed people in Germany worked at night at least occasionally in 2024 (Destatis, Mikrozensus 2024). A survey that sends its invitations and reminders only during office hours misses part of that group.
