10-Minute Data Protection Audit for Employee Surveys

The most common GDPR mistake in BGM doesn't happen when evaluating diagnoses — it happens with seemingly harmless employee surveys. Demographic questions that, in combination, make individuals identifiable constitute a data protection violation under Art. 9 GDPR.

What quickly goes wrong

A simple example: a survey asks about department + gender + age. In a small department with 4 people, where one person is female and over 55, that person is de facto identifiable — even without a name. That's enough for a GDPR violation.

A second classic case: the survey URL contains a personnel code or is sent via a personalized link. Even if the tool says "anonymous" — if the distribution is individualized, anonymity is voided.

The 3-point check

Before every survey, take 10 minutes for these three questions:

**Check 1 — Re-identification test:** Could the combination of demographic questions in small groups (fewer than 5 people) lead to identification? If so: either remove the demographic questions or merge groups.

**Check 2 — Voluntariness clause:** Does the survey's landing page state unambiguously: "Participation is voluntary. No IP addresses, cookies, or timestamps are stored"?

**Check 3 — Purpose limitation proof:** Is it ensured — both technically and contractually with the tool provider — that the data is used exclusively for BGM planning and deleted afterward? Linking it to performance reviews is strictly prohibited.