Map access before you promise confidentiality
You're ready to send an employee AI survey, and someone asks: “Can my manager read my answers?” A survey confidentiality statement example won't answer that for you. First, establish who can see responses, identifiers, comments and exports.
We think copying reassuring wording is a reasonable starting point, but reassurance falls short without verified arrangements. Check the access first, then write the promise.
AAPOR's Code, revised in June 2026, calls for survey researchers to restrict access to identifiers and destroy them when no longer required, subject to applicable rules. That's professional ethical guidance. Use these editorial checks to build your access inventory. Mark it complete when every data category has a named recipient, a recorded purpose and verified access permissions.
Sources: Standards and Ethics - AAPOR
Check what anonymity actually means
The ICO's UK anonymisation guidance, available on 19 October 2026 and under review, distinguishes anonymous information from pseudonymous information: pseudonymous information remains personal data. Removing a name isn't enough to establish anonymity.
Ask your survey administrator: “Can an invitation record, response ID or other information reconnect this answer to someone?” Treat this section as complete when your wording matches the confirmed collection and linking arrangements.
Use these suggested checks before describing survey questionnaire confidentiality.
Sources: Introduction to anonymisation | ICO
Separate group reports from comment access
The Cabinet Office's Civil Service People Survey notice, updated in September 2025, uses a threshold of at least 10 people answering the same question, with comments excepted. Its Survey Manager decides who can read open-ended comments. Those are arrangements for that survey, not a universal minimum or protection against identification.
In our view, a reporting threshold shouldn't carry the whole confidentiality promise. Explain comment handling separately, because a group-reporting rule doesn't describe who reads written answers.
Use these editorial checks, and mark them complete only after inspecting a sample report and confirming the comment workflow.
Sources: Privacy notice: Civil Service People Survey respondents - GOV.UK
Give retention and exceptions an owner
The ICO's UK GDPR guidance, available on 19 October 2026 and under review, says organisations must explain retention periods or criteria and, where applicable, recipients. It doesn't prescribe a survey retention duration.
Don't invent a convenient deletion date. We'd ask the accountable owner to confirm what happens to each copy before putting a deadline in the statement.
Complete these suggested checks with your privacy or legal owner. Completion means every data category has a confirmed retention period or criterion, an accountable owner and a deletion or review process, with applicable confidentiality limits confirmed. This is a general drafting checklist, not a complete privacy notice or a determination of compliance across jurisdictions.
Sources: What privacy information should we provide? | ICO
Survey confidentiality statement example: resolve every placeholder
Use this survey confidentiality statement example as an illustrative drafting aid, not a validated instrument. Confirm your employer's and supplier's actual access permissions, thresholds, comment controls, retention arrangements and disclosure exceptions before using this template.
“We collect [responses and metadata] to [purpose]. [Roles and suppliers] can access [data categories]. Managers receive [report contents] under [group-reporting rules]. Comments are [handling] and can be read by [roles]. We retain [each data category] for [period or criteria]. Confidentiality is subject to [confirmed limits]. Contact [owner] with questions.”
Check your completed survey confidentiality statement example against the arrangements you've verified. For an employee AI survey, anxiety and barrier answers remain employee self-reports; they don't establish causal productivity effects.
Your final check is simple: can the responsible owner substantiate every sentence? Use the checklist below before release.
Frequently asked questions
What if an operational detail is still unresolved?
Pause the launch until the unresolved detail has a confirmed answer. As editorial guidance, record the open question, assign someone to resolve it and set a decision date. Don't replace a missing retention decision or access rule with reassuring language that the survey team can't substantiate.
When should we check the statement again?
Review it before each new survey launch, as an editorial practice. Also reopen the review when suppliers, permissions, reporting groups, comment handling or retention decisions change. Keep a dated copy of the approved wording so the owner can identify which statement accompanied a particular survey round.
Can we use one statement across several countries?
Use a shared draft only as a starting point. As editorial guidance, ask the responsible privacy or legal owner to check each relevant jurisdiction and identify where local wording is needed. Keep the operational description consistent wherever the arrangements are the same, while checking applicable rights, contacts and exceptions separately.
