Short answer
An HR reporting threshold is one disclosure control, not a promise of anonymity. Test the exact output against small cells, visible totals, overlapping filters, earlier releases, exports, and recognizable free text. Set the audience and purpose first, suppress complementary values when subtraction would reveal a hidden cell, and review the whole release as a connected set of information.
What a response threshold does
A threshold can stop a dashboard from displaying a result based on fewer than a chosen number of respondents. It is useful because a very small group often makes inference easier. It does not establish that everyone in a larger group is unidentifiable.
The risk depends on the data, the audience, and the other information available. A cell of seven may still describe a single night-shift technician after role, site, tenure, and date filters are combined. A company-wide average may reveal a small team's result when a reader can subtract the rest of the company. A quotation can identify its speaker even when the chart beside it represents hundreds of people.
The UK Information Commissioner's Office says effective anonymisation requires an assessment of the practical means reasonably likely to be used to identify someone. Its motivated-intruder test is a useful discipline: consider what a determined reader could infer using the release, other available information, and reasonable effort.
Separate four ideas that are often collapsed
| Term | What it means for an HR report |
|---|---|
| Response threshold | A rule that prevents a cell below a set count from being displayed |
| Aggregation | Combining records into a group statistic or theme |
| Pseudonymisation | Replacing direct identifiers while retaining a way, held separately, to reconnect data to people |
| Anonymisation | Reducing identifiability so the resulting information is no longer personal data in the relevant context |
Removing names is not enough. Where an organisation retains additional information or other means reasonably likely to reconnect records to people, those pseudonymised records remain personal data for its processing. Whether information is personal data in another recipient's hands depends on that recipient's context and reasonably likely means of identification. Creating aggregate statistics from personal data is itself processing, even if the final output is effectively anonymous. The ICO's introduction to anonymisation explains this contextual assessment.
Do not turn a number such as five into a universal rule. The appropriate controls change with population size, attribute rarity, output sensitivity, reader knowledge, query flexibility, release frequency, and consequences of identification.
Use a release-risk worksheet
Complete one row for every chart, table, theme summary, quotation, download, and API response that a particular audience can obtain.
| Worksheet field | Question to answer |
|---|---|
| Purpose | What decision needs this output? |
| Audience | Which roles can view it, export it, or share it? |
| Base population | Who could have contributed, and is that population visible? |
| Filters | Which site, team, role, tenure, date, demographic, or response filters can be combined? |
| Cell rule | What threshold applies to counts, rates, averages, distributions, and themes? |
| Dominance | Could one or two people account for most of a value even when the count clears the threshold? |
| Linked releases | What totals, earlier reports, exports, or alternative breakdowns can this audience compare? |
| Text risk | Do comments contain roles, dates, events, health details, names, or recognizable phrasing? |
| Controls | Which cells and totals are suppressed, merged, rounded, perturbed, or withheld? |
| Review | Who tests the complete release and records the decision? |
| Recheck trigger | Which new filter, data refresh, audience, export, or linked report requires another review? |
The worksheet makes the unit of review explicit: the release available to the reader, not one cell in isolation.
Worked example: one hidden cell is still visible
This fictional example uses simple counts to show why a threshold alone is incomplete.
An operations report has 11 respondents across two teams:
| Output | Team North | Team South | Total |
|---|---|---|---|
| Completed a check-in | Suppressed | 7 | 11 |
If the threshold is five, hiding North seems consistent with the rule. But the hidden count is 11 - 7 = 4. The total and South cell disclose it by subtraction.
One response is complementary suppression: withhold another component or the total so the protected cell cannot be reconstructed. Another may be to publish an appropriately broader combined group. Which option works depends on all linked outputs. The Office for National Statistics explains why secondary suppression may be needed and why overlapping tables create differencing risk. Its rules are designed for official statistics, but the subtraction problem is directly useful when testing HR tables.
Now suppose the combined result of 11 is released on Monday. On Tuesday, a reader applies a filter that excludes one known contractor and receives a result based on 10. Comparing the two outputs may reveal that person's contribution or narrow the possibilities. The same risk arises when monthly reports overlap, team structures change, or separate exports use slightly different categories.
The fix is not always more suppression. Reduce unnecessary query flexibility, use consistent categories, keep a history of releases available to each audience, assess repeated-query risk, and consider controlled rounding or perturbation where the use case warrants specialist statistical disclosure control. The ONS's 2024 comparison of disclosure-control methods shows that thresholds, rounding, and perturbation have different utility and risk trade-offs.
Treat free text as its own release
A quotation can contain an identifier without naming anyone. “Since I moved from the Bristol night shift after the April shutdown” may be recognizable to colleagues. Removing “Bristol” leaves a date, shift, event, and unusual move that can still point to one person.
For every excerpt:
- identify direct names and contact details;
- test combinations of role, place, date, event, tenure, and personal circumstance;
- consider what the intended reader already knows;
- remove details that are not needed for the decision;
- paraphrase or summarize when exact wording adds identification risk;
- withhold the excerpt if its meaning cannot survive safer treatment; and
- assess the excerpt together with charts and earlier releases.
Do not promise participants that their words are anonymous merely because a reporting group has five members. Explain the actual access and reporting rules in language they can use to make a participation decision.
Put the rule into the operating process
A workable policy names more than the minimum cell count. Record:
- the roles permitted to access source material, aggregate results, and exports;
- standard groupings and filters;
- treatment of totals, percentages, averages, zeroes, and missing values;
- controls for repeated and overlapping queries;
- review rules for free text and sensitive topics;
- how reorganisations and small sites are handled;
- retention periods for source material, release logs, and exports;
- an escalation owner for unusual requests; and
- what employees are told before they contribute.
Keep the threshold stable within a declared reporting design. If a legitimate new purpose requires a different release, assess it as a new output rather than quietly lowering the rule after seeing the results.
Applying the worksheet to employee conversations
Lontra supports defined employee conversations, manager briefs, and aggregate reporting for HR. Managers do not receive raw employee responses. HR aggregate displays use a minimum group of five respondents, but that product rule does not guarantee anonymity in every organisational context.
Before use, apply the worksheet to your population, permissions, filters, reporting cadence, text handling, exports, and other information available to each audience. Confirm the employee explanation and the organisation's legal and governance requirements with the appropriate privacy owner.
Review Lontra's employee-conversation approach and reporting model, then test the planned release with examples drawn from your real team structure.
Frequently asked questions
Does a five-response threshold make an HR result anonymous?
No. It prevents one class of small-cell display, but identity can still be inferred from rare attributes, overlapping reports, totals, time slices, recognizable text, exports, or knowledge held by the reader.
What is complementary suppression?
It means withholding an additional cell or total when the first suppressed value could otherwise be calculated by subtraction. The choice should be tested across every report that an audience can compare.
Can verbatim employee comments be shared when the group clears the threshold?
A group count does not make a comment safe. Review the text for names, roles, dates, events, writing patterns, and combinations that colleagues could recognize; paraphrase, redact, withhold, or seek a safer level of aggregation.
