How to ensure DEI survey anonymity: five essential steps

Anonymity in a diversity survey is not a single feature — it is the cumulative effect of several deliberate design choices. Whatever platform you use, these are the five safeguards that decide whether a participant can ever be re-identified:

1. Use a dedicated third-party platform, not an HR system or generic form. Tools such as Microsoft Forms or SurveyMonkey tie responses to a login or email address and hand the raw data to an administrator. A purpose-built DEI platform sits outside your own systems, so no one internally can match an answer to a person in the first place.
2. Identify responses by a random ID, never a name or email. Each submission should carry only an auto-generated identifier — Divrsity uses a 128-bit GUID — that cannot be reversed back to an individual once the survey closes. No login, no email and no name is ever stored against the answers themselves.
3. Collect no cookies, trackers or IP addresses. Indirect identifiers are as dangerous as direct ones. Disabling cookies and IP logging removes the technical breadcrumbs that could otherwise be combined with demographic answers to single someone out.
4. Report results only in aggregate, and suppress small groups. Findings should appear as group-level summaries, never individual records, and any segment below a minimum size should be hidden automatically — Divrsity suppresses groups smaller than five by default, a threshold administrators can configure — so a small team can never be narrowed down to one identifiable person.
5. Purge the raw data — and the email list — as early as possible. Email addresses should be deleted as soon as invitations and reminders have been sent, and raw responses irrecoverably purged shortly after the survey closes (Divrsity holds them 7–10 days). Once purged, even a GDPR Subject Access Request returns nothing.

Crucially, anonymity only lifts participation if people believe in it. Communicate each of these safeguards plainly — in the invitation, in your communication strategy, and on the survey itself — because perceived anonymity drives honest answers as much as the technical measures do.

In the bad old days... (before Divrsity )

We see a lot of companies attempt to collect D&I information through their HR system, via general tools such as Microsoft Forms / SurveyMonkey, or via dedicated employee survey tools such as Peakon / CultureAmp.

While those are all excellent tools, they have one thing in-common: to be useful for Diversity & Inclusion surveys they, by definition, generate a vast amount of Personally Identifiable Information (PII), in a form that makes it easy to determine which specific responses pertain to a particular employee. e.g. Microsoft Forms actually associates responses with an Active Directory account and makes all the raw survey results available to the survey administrator. These are typically downloaded to that user's computer for analysis... and now we're in a world of data security pain.

It's worth noting that the ability to connect survey responses to an individual may be either direct (through email address or login details), or indirect through the combination of multiple data fields in the raw results (this employee is in New York, and in the Finance Team, and has joined in the past year - therefore it must be Humphrey).

To avoid compromising survey quality, we therefore need to reassure colleagues that the data we collect will be anonymous, and used only for the purposes of improving Diversity & Inclusion within our organisation.

Divrsity has been designed and built to obsessively protect participant anonymity

In practice, this means that we ensure that our PII footprint is sufficient for us to provide our service, and absolutely nothing more. Consequently, even in a worse-case situation such as our servers being compromised, there is effectively no PII available for hackers to exploit.

N.B. For employers, this has the positive side-effect that a GDPR Subject Access Request would reveal zero information about a given participant.

Some examples of the steps we take to ensure participant anonmyity include:

• For survey participants, we avoid all trackers, we place no cookies, and we configure our servers to avoid collecting IP address information
• Raw survey responses are identified only by a Globally Unique Identifier (a "GUID"): a 128-bit random number that is auto-generated by our systems. Once the survey is complete, this number cannot be tied back to an individual employee
• Since we have no legitimate need to contact them again, we immediately purge a participants e-mail address from our database when they have completed their survey.
• For the same reason (that we have no need to contact them again), we immediately purge e-mail addresses once the reminder e-mail has been sent.
• As a consequence, when a survey completes we have no PII, and no way to tie raw survey responses back to a unique individual.
• When the survey completes, we summarise and store the results. These results are provided to the survey administrator via the Divrsity website and can only be accessed in aggregated, completely anonymised form. N.B. We never share any company's results with other clients or prospects.
• We typically store raw survey responses for 7-10 days after the survey has completed (although this can be configured). After this time, they are irrecoverably purged and only the summarised results remain.

Obviously we also do everything we can to protect the data that we do store. This includes using AWS for all our data, ensuring that data is encrypted at-rest and in-transit; and enforcing strict security policies on our technology and our team.

Frequently Asked Questions

How do you ensure anonymity in a DEI survey?

To make a staff survey genuinely anonymous, run it through a dedicated third-party platform rather than an HR system or generic form, identify each response by a random ID instead of a name or email, log no cookies or IP addresses, report results only in aggregate, automatically hide any demographic group smaller than five people, and purge the raw data once the survey closes. Then tell participants you have done all of this: perceived anonymity drives honest answers as much as technical anonymity does.

Are anonymous diversity surveys really anonymous?

They can be, but most anonymous staff surveys are not. A survey emailed from an HR system or built in a generic form tool ties answers to a login, a unique link or an address, so the provider or administrator could re-identify a respondent. True anonymity requires a platform that stores no personally identifiable information: on Divrsity each response is tagged only with a random 128-bit identifier, the email is purged on completion, and not even Divrsity staff can view an individual's answers.

Can anonymous surveys be traced?

Often, yes. The usual routes are a per-person survey link or login that the tool quietly records against the response, IP addresses and timestamps in the server log, free-text answers that mention identifying details, and demographic breakdowns so small that one person is obvious. Ask any provider which of these it stores. A survey is only untraceable when the response record holds a random identifier and nothing else, server logs are not linked to responses, small groups are suppressed, and the email list is deleted when the survey closes.

Do DEI surveys need to be anonymous?

In practice, yes. Demographic answers about ethnicity, religion, sexual orientation, disability and health are special category data under UK GDPR, so holding them against named employees needs a lawful basis, safeguards and a retention policy, whereas genuinely anonymous data falls outside data protection law altogether. Anonymity also drives honesty and participation: people will not disclose a disability or report exclusion if they believe HR can see who said it. For a diversity survey, anonymity is the safer legal position and the better data.

Can my employer see my individual DEI survey answers?

On a properly anonymous platform, no. Administrators see only aggregated, group-level results, never individual records, and small demographic groups are suppressed so no one can be singled out. Because Divrsity purges the email list and raw responses after the survey closes, there is no dataset left that could link an answer back to a named employee, even on request.

What is the minimum group size for an anonymous survey?

To protect anonymity, results for very small groups should be hidden rather than displayed, because a small enough group can be narrowed to one identifiable person. By default Divrsity automatically suppresses any demographic breakdown with fewer than five respondents, a threshold administrators can configure, while still letting you analyse larger groups in full detail.

What is the difference between an anonymous and a confidential survey?

In a confidential survey someone, usually a provider or administrator, can still link answers to individuals but promises not to. In a genuinely anonymous survey that link does not exist at all: responses are never tied to a name, email or IP, so re-identification is impossible by design rather than by policy. For sensitive demographic data, anonymity is the stronger and safer standard.

Create your D&I survey...

More Blog Articles

• Alongside anonmity we recommend checking out Legal and Ethical considerations of EDI Surveys
• And, for company director's, you can learn more about considerations when running EDI Surveys.
• See how we use AI to generate D&I insights
• Or Learn Why we created Divrsity