The short answer
To create an anonymous survey, removing the name and email fields is only the first step. Also check that no two or three answers together point to one person, that the survey tool records no sign-ins, invitation emails or IP addresses, and that you never report a group of fewer than 5. If you or the tool can still link an answer to a person, call the survey confidential, not anonymous.
Most guides to anonymous surveys stop at removing the name and email fields and switching off IP address logging. People are still recognised through the rest: a question about their team, a comment only they could have written, an invitation link with their address in it, or a results table with a column for a team of three.
Anonymous or confidential: decide which one you offer
An anonymous survey never knows who answered: not you, not your team and not the survey tool. A confidential survey knows who answered, or could find out, and promises to limit who sees individual answers and to report only in groups, as Microsoft's Viva Glint employee surveys do.
Pick one and say it in the first line of the survey. "Your answers are anonymous: we do not collect your name, email or IP address" is a promise people can check. So is "Your answers are confidential: only HR sees individual responses, and we report groups of 5 or more." Calling a confidential survey anonymous is the choice that breaks trust when someone finds out.
Apply the legal test: could someone who knows them work it out?
Under GDPR, the European Commission says data rendered anonymous so that a person is no longer identifiable is not personal data, and that the anonymisation must be irreversible. Answers with a respondent ID that a separate list links to a name stay personal data.
The UK regulator, the ICO, says in its 2025 anonymisation guidance that removing direct identifiers such as names is not enough. Ask whether a "motivated intruder" could identify someone: a reasonably competent person with ordinary resources, who might ask people who know the individual.
The risk does not have to be zero, only sufficiently remote: the same question is a different risk in a survey of 2,000 customers and in one of 12 colleagues. For each question, picture a colleague of the respondent reading the results. If they could say "that's Sam", the survey is not anonymous. If it covers employees, health or anything sensitive, talk to your DPO or lawyer before you launch.
Step 1: Remove the direct identifiers
Start with the fields that name someone outright:
- Name, email, phone, and employee, customer, order or ticket numbers.
- "Optional" contact fields, which turn some answers into named ones.
- "Can we contact you about your answer?", which needs a way to reach the person.
- File uploads and photos, which often carry a name or a face.
For people who want a follow-up, add a separate form after they submit, with its own link and results, so an answer and an address never share a row.
Step 2: Find the answers that identify people in combination
No single question names anyone, but two or three together can narrow the group to one person. Look for:
- Teams, offices, shifts or year groups with only a few people in them.
- Combinations of team, job level, years in role, age band, gender and location. Each is harmless in a large organisation; two or three together can describe one person.
- Free-text answers, which mention a manager, a project or a situation everyone recognises, in a writing style colleagues know.
- Timestamps. If someone mentions they answered during a meeting, the time on their response points to them.
- Rare answers. The only person who chose "Other: part-time contractor" is not anonymous to anyone who knows the team.
Drop any grouping question you will not act on. For the ones you keep, use bands broad enough that every option, and every combination of two questions, has at least 5 people in it.
Tip: The anonymous survey checker flags the questions most likely to identify people. Paste your questions in, one per line.
Step 3: Turn off what the survey tool records behind the scenes
The tool can identify people even when no question does, through sign-in, named email invitations, personal or tracked links, IP addresses, cookies and device details.
| Tool | What it can record | What to change |
|---|---|---|
| SurveyMonkey | Most collectors record IP addresses by default, and email invitations include each email address. IP addresses are kept in backend logs for 13 months. | Turn on Anonymous Responses in every collector, and do not send custom data or variables that identify people. |
| Google Forms | With Collect email addresses set to Verified, the respondent must confirm their Google Account email, which is saved with the response. | Do not collect email addresses. |
| Microsoft Forms | For forms limited to people in your organisation, Record name saves each respondent's name with their answers. | Clear Record name before sharing. |
| Qualtrics | IP address and location data. With individual links, each response is tied to a contact. | Turn on Anonymize responses, ideally before the first response. |
Change the settings before you share. Qualtrics says responses recorded before you turn on its setting keep their information, and SurveyMonkey asks you to turn its setting on in each collector separately.
Share one link, not personal links by email, which let the tool connect each answer to an address even if the results page does not show it. Then submit a test answer and open the raw export. If any column points to you, fix the setting and test again.
Step 4: Set a minimum group size of 5 before you read results
If a team of three all answer and the team average is 2 out of 5, everyone in that team knows roughly what the others said. Decide the smallest group you will report on before any answers arrive, and write it down.
Use 5 as the floor. The ICO describes k-anonymity, where each record shares its details with at least k-1 others, and notes that the NHS standard sets k to 5 for strong anonymisation. Viva Glint, by default, hides scores for groups with fewer than 5 responses and comments for groups with fewer than 10.
Watch out for subtraction: show the whole organisation and every team but one, and anyone can work out the missing team. Viva Glint also hides the next smallest group to stop this. In a small organisation, merge small teams into one "Other" group, or do not split results by team at all.
Example: a small charity runs a staff survey
Example
Say you run a charity with 34 staff in four teams: Services (14), Fundraising (10), Finance (6) and Operations (4). Your draft survey asks for team and for years in role (under 1 year, 1 to 3, 4 to 9, 10 or more), and is set to go out as personal email invitations.
Count first. Operations has 4 people, below 5 on its own, and only one of them joined this year, so "Operations, under 1 year" is one person. Your finance manager is the only person in Finance with 10 years or more.
So you drop years in role, because no decision depends on it. You merge Finance and Operations into "Central teams", which leaves three groups of 14, 10 and 10. The rule is 5 answers, not 5 staff: if only 4 people in Central teams reply, that group shows nothing. Comments are shown only for the whole charity.
You switch to one shared link in the staff channel, turn off IP address collection and submit a test answer: the export shows the answers and the time, nothing else. The first line of the survey now reads: "This survey is anonymous. We do not collect names, emails or IP addresses, and we only report groups of 5 or more."
How to create an anonymous survey: the checklist
Run it on a draft or on a survey you already use. Every "no" is a fix before the next round.
- The first line says "anonymous" or "confidential", and what you collect. If you or the tool can trace an answer, it says confidential.
- No question asks for a name, email, phone number, or employee, customer or order number, including optional fields and "Can we contact you?".
- Every grouping question (team, role, location, age band) feeds a decision, and every option, alone and combined with one other question, covers at least 5 people.
- Free-text boxes are optional and ask people not to include names or details others would recognise.
- People reading the results cannot see when each response was submitted.
- Sign-in, name and email collection are off (Record name in Microsoft Forms, Collect email addresses in Google Forms), and the survey goes out as one shared link, never personal or tracked links.
- IP address collection was off, in every collector or link, before the first response, and you know how long the tool keeps its own logs.
- A test answer, opened in the raw export, shows nothing that points to you.
- The smallest group you will report is written down: 5 answers for scores, more for comments, and no table where subtracting one group from the total reveals another.
- A colleague of any respondent, reading the results, could not say who wrote any answer.
Where Asklet fits
Asklet asks a short survey on the page, through one iframe snippet, with no sign-in, cookies, tracking identifiers or fingerprinting. It stores the answers, the page path and the time, not names, email addresses, IP addresses or device details, and removes emails and phone numbers typed into free text. That covers steps 1 and 3.
Steps 2 and 4 stay with you. Results show only counts, with no percentages or averages, until a page, theme or website has 10 responses in the selected period. The counts are still visible, so that is not a minimum group size: if you ask which team someone is in, or embed the widget on an intranet page four people visit, small groups are still your problem.
Your next steps
-
Write the first line of your survey
Choose anonymous or confidential, and write the promise with what you collect and what you do not.
-
Count your smallest groups
For each grouping question, and each pair of them, find the option with the fewest people. Merge or drop any under 5.
-
Fix the tool settings, then test
Turn off sign-in, email collection and IP addresses, share one link, then submit a test answer and check every column of the raw export.
-
Write down the reporting rule
The smallest group you will show: 5 answers for scores, and a higher number for comments.
Try these steps on your own site. Asklet adds the questions to every page with one snippet. Compare the plans.
Start freeCommon questions
What is the difference between an anonymous and a confidential survey? Nobody can link an answer in an anonymous survey to a person, not even through the survey tool. A confidential survey can, but limits who sees individual answers and reports only in groups.
Can an anonymous survey be sent by email? Yes, if the email contains one shared link rather than a personal link for each person. SurveyMonkey's email invitations, for example, include each respondent's email address unless you turn on Anonymous Responses.
Does GDPR apply to anonymous survey answers? Not to answers that are truly anonymous: the European Commission says data rendered anonymous, so that the person can no longer be identified, is not personal data. Answers that can still be traced back, through a respondent ID or an IP address, remain personal data.
Related
Sources
- ICO: Anonymisation: how do we ensure anonymisation is effective? (2025)
- European Commission: Data protection explained
- Microsoft Learn: Manage Viva Glint confidentiality thresholds (2026)
- SurveyMonkey Help: Making responses anonymous
- Google Docs Editors Help: View and manage form responses
- Microsoft Support: Set up your survey so names aren't recorded
- Qualtrics Support: Security survey options