Anonymity Protection
Maintaining participant anonymity is essential for creating a safe space where employees feel comfortable sharing honest, constructive feedback. At PeopleCues, our survey system is designed to protect anonymity while still allowing you to perform in-depth analysis and uncover actionable insights.
Protection against Individual Response Identification
Individual Response Identification occurs when survey filters are applied in a way that could reveal who submitted a particular response. To prevent this and safeguard anonymity, PeopleCues enforces a minimum threshold of 3 responses upon every group and its subsets. Survey results for any team, demographic, or filter will only be shown if at least 3 employees have responded.
To understand Individual Response Identification better, consider the following example:
Tech
8
Yes
Product
7
Yes
Marketing
2
🔓No
Operations
5
Yes
Business
1
🔓No
Protection against Inferential Response Identification
While we prevent direct identification of individual responses, Inferential Response Identification is a more subtle risk. It occurs when someone can guess a hidden score based on surrounding visible data, especially when the hidden group is very small.
To mitigate this, PeopleCues adds an extra layer of protection by automatically hiding an additional group, typically the next smallest group, even if it meets the minimum threshold. This prevents anyone from piecing together individual scores through comparison.
Example: How Inference Can Happen
Let’s say: A company has only two departments -
The overall company eNPS is 55
The Tech team’s eNPS is 60
The Product team’s eNPS is hidden (only 1 person responded)
Even though the Product team’s score is hidden, someone might infer that the single respondent gave a very low score, because it's the only explanation for why the overall company score is lower than Tech's.
To prevent this kind of deduction, the system may also hide the Tech team’s score (the next smallest group), even if they meet the response threshold, protecting the anonymity of the lone Product team respondent.
Responses
8
7
1
eNPS
53
🔓No
🔓No
Example 2: How Inference Can Happen
Let’s say:
The Tech team has 7 respondents with an average eNPS score of 60 → 7 × 60 = 420
The overall org score (8 respondents total) is 53 → 8 × 53 = 424
From this, it’s easy to calculate that the 1 hidden respondent (from the Product team) must have scored 4 (424 - 420 = 4). This exposes the individual’s response, even though it wasn’t shown directly.
The system hides the next smallest group, even if it meets the threshold.
This prevents users from back-calculating individual responses based on visible group data.
Tech
8
Yes
Product
7
Yes
Operations
5
🔓No
This is the 2nd smallest group so this is also hidden to protect Content department scores
Content
2
🔓No
Scores not visbile due to less than 3 responses
Last updated