10-Minute Data Protection Audit for Employee Surveys

A common GDPR mistake in WHP does not occur when evaluating diagnoses — it happens during seemingly harmless employee surveys. Demographic questions that, in combination, make individuals identifiable, remove anonymity: The answers become personal data – and health information is particularly protected under Art. 9 GDPR.

What can quickly go wrong?

A simple example: A survey asks about department + gender + age. In a small department with 4 people, where one person is female and over 55, this person is de facto identifiable — even without a name. Then the answers are personal, and the GDPR applies with all its obligations.

A second classic: The survey URL contains a personnel code or is sent via a personalized link. Even if the tool says "anonymous" — if the distribution is individualized, anonymity is lost.

Which three points should you check before every survey?

Before every survey, spend 10 minutes on these three questions:

**Check 1 — Traceability Test:** Can the combination of demographic questions in small groups (fewer than 5 people) lead to identification? If yes: either remove demographic questions or combine groups.

**Check 2 — Voluntariness Clause:** Is it clearly stated on the survey's start page: "Participation is voluntary. No IP addresses, cookies, or timestamps are stored."?

**Check 3 — Purpose Limitation Proof:** Is it ensured — both technically and contractually with the tool provider — that the data is used exclusively for WHP planning and then deleted? Linking with performance evaluations is strictly prohibited.

How to set up a survey in compliance with data protection and use the results is shown in the guide Employee surveys for WHP.