To safeguard anonymity in surveys, many organisations ask for results to be displayed only once a certain number of participants has been reached. Suggested thresholds vary arbitrarily, often between 5, 7 or 10 people. This anonymity threshold, sometimes called a reporting threshold or analysis threshold, may feel reassuring, but it does not originate in market research or statistics. Some survey tools have implemented this requirement uncritically, creating a false sense of security and unnecessary data loss. What matters for anonymity is not how many people answered a question, but how many people could have answered it. The following sections explain why an anonymity threshold does not achieve its intended purpose, why a fixed minimum number of participants can even be counterproductive, and what you should consider instead to preserve anonymity when conducting and analysing surveys.
Table of Contents
Anonymity does not depend on the number of responses
- ACME Group has Department A.
- 100 women work in this department.
- Two women from Department A take part in the survey.
- ACME Group has Department B.
- Two women work in this department.
- Both women from Department B take part in the survey.
- The responses from the “female” + “Department B” group are probably not anonymous.
- gender + age + location
- department + role + management level
Safeguarding anonymity: a three-step approach
First, determine the possible underlying populations, in other words the actual group sizes. This is necessary regardless of whether a survey tool offers any form of “minimum participation” feature.
In practical terms, you can proceed as follows:
Step 1: Identify questions about quasi-identifiers in your questionnaire
Quasi-identifiers are characteristics that can help describe and distinguish people. These include questions about sociodemographic characteristics such as:
- gender
- age
- department / team
- location
- role / function
- management level
- length of service
| What are quasi-identifiers? |
|---|
Quasi-identifiers are sociodemographic characteristics that do not usually identify a person directly, but may make them identifiable when combined. Examples:
|
Step 2: Determine the size of all groups formed by these characteristics
For each characteristic and each combination of characteristics, ask:
- How many people in total have this characteristic?
- How many people fall into each combination? (e.g. gender + location + age)
| Identifying possible groups: an example calculation |
|---|
A brief mathematical example: if you ask about only three characteristics (gender, age and location), and each has a handful of categories, the calculation looks like this:
Assuming that any combination could contribute to identifying respondents, rather than only combinations involving all three characteristics, this produces 79 possible groups. Any one of them may be too small to remain anonymous. Just three seemingly harmless sociodemographic characteristics create 79 possible groups, any of which may be too small to remain anonymous. A minimum participant count has no effect on this. If we add 10 departments and 8 roles, the number rises to 11,879 possible groups. At this point, you should critically review your questionnaire. |
You have now determined the group sizes and found that some combinations represent fairly large populations (e.g. “male + 40–59”), while others remain small (e.g. “diverse + Location B”). But what counts as small, and when is a group “too small”?
There is no universal fixed number that is always safe and guarantees anonymity. This is supported by both the specialist literature and current studies. Instead, the recommendation is to take a risk-based approach and set appropriate thresholds individually, based on the participant structure and the information already known.
What matters is not a rigid threshold, but a reasoned decision:
Can a person blend into this group, or are they effectively identifiable on their own?
Whether a group is anonymous depends on the context: the characteristics involved, the structure of your workforce and the possible combinations. A single fixed minimum group size cannot reliably reflect this risk.
Step 3: Remove or aggregate groups below an appropriate minimum size
You have already identified the groups and determined their sizes, or defined appropriate thresholds. You now have several ways to avoid groups that are too small and risky, while reducing the total number of groups.
1. Reduce the characteristics or categories you collect
Critically assess which characteristics are actually necessary for the analysis. Many questionnaires collect more sociodemographic characteristics than the specific project requires, creating numerous very small groups.
For example, “role” or “length of service” may be relevant, but they are often collected simply out of habit even when they are not needed for the specific research question or create only very small groups.
2. Aggregate characteristics and categories to create larger groups
Combining categories reduces the number of possible groups while increasing their size. Consider the actions you may actually derive from your survey project. Can you realistically implement different measures for each age band such as 40–45? If not, aggregate the categories.
Examples:
- Ask about age using three broad bands rather than ten categories.
- Combine numerous locations by function (production, sales) or region (north-east, south).
- Omit gender, or use three categories rather than five identities.
| Gender, sex, diversity and anonymity |
|---|
For surveys in English, ESOMAR recommends asking about “gender” (social identity) rather than “sex” (biological sex). In German, the distinction is less pronounced because the word “Geschlecht” can cover both. The question of categories nevertheless remains: offering only “male” and “female” is not inclusive. However, asking separately about “diverse” will, in practice, almost always create very small groups in employee surveys that cannot be analysed anonymously. Before asking the question at all, consider whether gender is relevant to the particular survey project. Gender is routinely collected in many surveys, but although differences between men and women exist in many areas, they are not relevant in every context and often do not change either the interpretation of results or the actions taken. Our recommendation is to offer “female”, “male” and “prefer not to say / other”. This protects respondents’ anonymity, supports data minimisation and avoids very small groups that cannot be analysed meaningfully. At the same time, the question remains sufficiently inclusive without compromising the analysis. Communicate your decision openly in advance or directly alongside the question. |
3. Less useful: restrict reporting functions (no raw data, no filters)
Reporting functions can contribute to the identification of individuals, for example through small samples, raw-data analysis or filtering. Restricting reporting can reduce these risks: filtering or raw-data analysis can be disabled for your account. However, this may also make many questions unnecessary, such as gender in employee surveys, if the results cannot meaningfully be broken down by that characteristic anyway.
4. Seemingly useful, but still not anonymous by another route
Example: a condition such as “If Department A, skip the gender question” is intended to protect small groups, but can create new risks.
The group can then be narrowed down indirectly by asking “Who did not see this question?”, potentially making individuals identifiable.
Why a fixed minimum participant count can actually be harmful
Making a fixed minimum number of participants or respondents a condition for displaying results does not solve the anonymity problem. A minimum participant count does not protect against re-identification. Instead, such a rule creates a false sense of security and can also lead to unnecessary data loss.
Three reasons why a minimum participant rule is flawed:
- A “fewer than X participants” rule has no scientific basis
There is no evidence that suppressing small cell counts actually prevents re-identification. Thresholds such as 5, 7 or 10 are often chosen arbitrarily rather than determined through a risk-based assessment. - The wrong focus: numerator instead of denominator
The size of the potential underlying population, the denominator, determines the risk of re-identification. Fixed minimum participant counts focus solely on the numerator, the number of responses. This is a fundamental conceptual error. - It causes unnecessary data loss, poorer data quality and exclusion
Fixed minimum thresholds suppress results even when there is no genuine risk.
For example:
Four people submit a response. > The tool requires five. > Result: the data is suppressed or, in the worst case, deleted.
This blanket suppression creates:
- loss of information
- artificial gaps in the data
- poorer analysability
- less meaningful results
- ignored voices and the exclusion of people whose valid feedback is not taken into account
This is particularly problematic when the underlying population is large, for example 200 employees in a team. In that case, the risk of re-identification would be practically zero despite there being only four responses.
The one edge case: when a minimum participant count can actually be useful
There is only one special case in which a minimum participant count can play a role, and it applies only under very narrow conditions. A minimum participant count is relevant only when all of the following conditions are met:
- the size of the underlying population is unknown;
- the size of the underlying population becomes known after the survey;
- it turns out to be very small; and
- during or after the survey, information emerges that could make this small group identifiable.
For example:
A survey is launched at the beginning of the year and remains open throughout the year. One question asks: “Did you attend external training in 2025?”
- The size of the response group is unknown in advance: at the outset, nobody knows how many employees will attend training during the year. (If this were known, the anonymity risk could be assessed. You could then omit the question, separate it from the rest of the questionnaire, or ask it normally.)
- The information is known after the end of the year: it is now known how many employees attended training. (Without this information, it may not be possible to draw conclusions about the individuals concerned.)
- The group turns out to be very small: at the end of the year, it becomes clear that only one person attended training. (If the group were very large instead, de-anonymisation would not be possible.)
- Information obtained later makes the group identifiable: it becomes known internally which person in the organisation attended training. (Without this information, anonymity is preserved regardless of the other conditions.)
That one person would then be clearly identifiable.
Rather than relying on minimum participant counts, which are often applied incorrectly or inappropriately, LamaPoll provides a different option: the “separate analysis” function.
If it is foreseeable that only a few people may ultimately select a particular response option, the question can be configured so that it is analysed entirely separately from the rest. This ensures that even if an individual response later becomes identifiable, the remainder of the questionnaire stays anonymous and cannot be linked to that identifiable response.
In such cases, you should also consider whether the question is genuinely necessary or whether the information is already available elsewhere. If the information exists elsewhere, there is no need to collect it again through the survey. If it is not recorded anywhere else, the question itself is not problematic, even if only one person ultimately selects that response option.
What the research says
1. The familiar “fewer than X cases” rule is not merely controversial; evidence shows that it is unsuitable. One example:
The study “Less than five is less than ideal: replacing the ‘less than 5 cell size’ rule with a risk-based data disclosure protocol in a public health setting” shows clearly that:
- a fixed “fewer than X” threshold is arbitrary, lacks scientific evidence and does not provide reliable protection;
- it often unnecessarily prevents relevant data from being analysed and published; and
- modern approaches in health statistics increasingly replace this rule with risk-based methods.
Scientifically established methods such as k-anonymity and its extensions, l-diversity and t-closeness, likewise show that:
- the issue is not simply the number of people;
- what matters is the disclosure risk associated with the attributes; and
- small groups are risky only when they are sufficiently distinctive or unique.
None of these models uses fixed thresholds such as “5”.
2. Eurostat and disclosure-control guidance
Eurostat and international statistical disclosure control (SDC) guidance likewise do not recommend universal fixed minimum cell counts. Instead, they call for a context-dependent approach:
- assessing the actual risk of re-identification;
- using targeted safeguards such as aggregation or suppression of individual cells; and
- avoiding a universal minimum cell-count threshold or “magic number”.
3. Key takeaway
Research and statistical practice agree that anonymity depends substantially on the size of the underlying population and on information already available, not simply on the number of responses. Data protection does not result from a fixed participant count, but from assessing the actual disclosure risk.
Conclusion
Minimum participant counts do not increase anonymity. They merely hide data, create a false sense of security and discard valuable feedback. There is no scientific basis for such a minimum count: the number of responses does not determine the risk of re-identification; the size of the underlying groups does.
To safeguard genuine anonymity, you therefore need to assess the underlying populations, avoid very small groups, aggregate characteristics appropriately and omit unnecessary sociodemographic questions rather than simply suppressing responses. Established, internationally recognised data-protection methods support this approach: anonymity depends on context-specific assessment and appropriate data preparation, not rigid rules based on case numbers.
Minimum participant counts are therefore not a safeguard, but a convenient yet ineffective heuristic. A risk-based, methodologically sound approach can protect data while ensuring that each person’s feedback can still contribute meaningfully to the analysis.
What is LamaPoll?
LamaPoll is an online survey tool for creating employee surveys and measuring employee satisfaction. With us, you can create, conduct, and analyse all types of employee surveys.
Set up your employee survey in just a few steps, customise it with your company's corporate design, and invite your employees conveniently by email or via your intranet. You'll gather insights to boost employee satisfaction in no time. Sign up for free with our online survey tool. You can then run surveys for up to 50 employees immediately and with no obligation. If you need more responses for your online employee survey, simply use our monthly plans. You can also make use of our templates and examples for employee survey questionnaires.
