A manager should not be able to solve the survey respondent

## Read the views together, as a manager will

A survey report is rarely read in isolation from everything a manager already knows. The manager knows who joined recently, who works in a particular location, who has a specialist role and who experienced a distinctive event. A dashboard that removes names can therefore leave enough clues for a respondent to become recognisable. The risk grows when several filters can be combined. Each individual view may appear broad enough, while their intersection describes one person or a very small group. Reviewing the report only one screen at a time misses the way it will actually be used.

I helped create that problem in the fictional Lorqavi exercise by asking for additional detail. We had 368 responses from 520 eligible employees, and broad averages did not explain every local concern. Managers wanted team, tenure, role and location views. I supported the request because I wanted the feedback to lead to action. The privacy review then showed how the combined views could reveal more than any one of them appeared to disclose. My intention to make the report useful did not remove the consequence of the design. We had to reconsider the report before treating more detail as an unqualified improvement.

The organisation contained 46 teams for reporting purposes. Eighteen had fewer than five responses, so their team-level reports were suppressed. That was a necessary step in the fictional process, but it was not a universal proof that the other 28 reports were safe. We also examined combinations of views, distinctive circumstances and the content of comments. A threshold can be a useful rule within a review while remaining insufficient as the entire review. The relevant question is what a reader can infer from the available material and their existing knowledge, including conclusions that the report itself never explicitly states.

Free-text comments need particular care because removing a name does not remove a distinctive experience, phrase or role description. A quotation may be vivid precisely because it contains the detail that makes the speaker recognisable. We excluded identifiable free text from dashboards and considered whether broader summaries could preserve a useful concern without exposing the person. That required judgement rather than a simple search for names. It also required restraint: not every compelling quotation belonged in a management presentation. The organisation had invited employees to describe their experience, not to supply evidence for a guessing exercise about their colleagues.

## Accept the cost of a less precise report

The reporting and privacy work cost ₹22 lakh. The resulting reports also contained less local detail than some managers wanted. That was a real disadvantage, and I did not want to dismiss it with a general statement that privacy always makes every decision easier. A manager who cannot see a small team's separate result may find it harder to identify a particular working condition that needs attention. The response should explain what can still be learned and how a responsible discussion can proceed. It should not pretend that broader aggregation preserves every benefit of the more detailed version.

We reduced filters and used wider aggregation where the combination could reveal people. The remaining views still required examination in context. The organisation also needed to explain the limits of confidentiality before employees responded, rather than offer an absolute anonymity claim and discover exceptions later. A clear promise can be narrower than a reassuring slogan and more trustworthy because it describes what the process can actually support. People may choose what to share differently when they understand those limits. That is part of respecting their participation, not an inconvenience to be concealed for the sake of a higher response count.

The 368 responses were valuable, but they did not represent a complete account of every employee's experience. The remaining eligible employees might have had many reasons not to respond. We could not assign them a single opinion or assume that non-response proved fear, satisfaction or indifference. Similarly, a report with fewer identifiable details did not prove that all respondents felt safe. The organisation needed to keep those limits visible when using the findings. A survey provides evidence about the responses received under its conditions. It does not become an unlimited description of the workforce simply because the dashboard is polished and the participation figure is prominent.

Future exercises would need another review because the risk changes with the organisation. Teams merge, people move and a previously broad category can become distinctive. New filters or other accessible reports can also change what a manager can infer. I would therefore avoid treating one approved design as permanently suitable. The work is ongoing: understand the reporting context, test the combinations and decide whether the expected management use remains proportionate. That continuing expense and attention belong in the plan. Privacy should not depend on a one-time exercise whose assumptions silently expire while the report continues to circulate.

## Provide a route for action that does not require identification

Managers sometimes asked how they could act without knowing exactly who had raised a concern. Some issues do require individual discussion through an appropriate channel, especially where a person needs a specific response or where a matter requires formal handling. A general survey is not a substitute for every such process. The organisation should explain the available routes and their conditions rather than force an individual issue into an aggregated dashboard. Sensitive concerns need suitable ownership and handling, with professional advice where required. Their existence does not justify exposing everyone who contributed to a broader feedback exercise.

Other concerns can be discussed without identifying the speaker. A manager can examine meeting practices, workload allocation or access to development with the team as a whole, while making clear that nobody is being asked to reveal a survey answer. The discussion should invite improvement, not seek confirmation of a suspected respondent. It also needs care not to turn a broad concern into a group assumption about every person's experience. Managers can describe what they are willing to change, listen through appropriate channels and review the effects. Action can be specific about working conditions without being specific about who first supplied the evidence.

For a board, the central question is whether management has designed a trustworthy process for hearing and responding. Directors do not need access to identifiable comments to take employee experience seriously. They can ask how reporting risks are assessed, what promises are made to respondents, how individual concerns find a suitable route and what management changes after receiving the findings. They can also ask whether success is being measured only by response volume and favourable scores. A process that produces attractive participation statistics while making people easier to identify may undermine the candour that the next exercise will need.

The Lorqavi outcome was a smaller set of reports, with eighteen team views suppressed and further scrutiny applied to the remaining 28. It was not a claim that every privacy risk had vanished or every workplace issue had been resolved. I accepted responsibility for seeking filters before considering their combined effect. The experience changed what I mean by actionable feedback. A report should support a responsible response to working conditions, within promises the organisation can keep. If its usefulness depends on allowing a manager to work out who spoke, then the design needs another examination before the next employee is asked to trust it.