Employee Surveys & Data Privacy: What You Need to Know

Employee surveys are a popular method for optimizing internal processes. However, to ensure this data collection does not violate the GDPR, management must adhere to several important rules.

Data protection in employee surveys: Legal basis

Employee surveys can uncover issues, improve workflows, and increase employee satisfaction. Furthermore, a company that values its employees' opinions appears trustworthy and modern to potential applicants.

However, data protection must not be neglected during employee surveys. If you collect personal data from your staff for a survey, it must be done in compliance with data protection regulations. If you collect personal data in employee surveys, you need a legal basis. The employee data protection applicable here falls under the general regulations of the GDPR. According to Section 26 of the German Federal Data Protection Act (BDSG), the processing of personal data is only permitted for the purposes of the employment relationship. Since a survey on employee satisfaction is not necessary for the execution of the employment relationship, Section 26 BDSG is generally ruled out as a legal basis for employee surveys.

For most employers, it is beneficial to know how satisfied employees are with the atmosphere and work processes. However, companies cannot force their employees to participate in a survey. This can only be implemented on a voluntary basis, which requires consent according to Art. 6 (1) sentence 1 lit. a GDPR. Nevertheless, employees may feel pressured to give their consent. Many fear negative consequences for their standing in the company if they refuse to participate in such an internal measure or express their criticism of the company under their real name.

Conducting employee surveys anonymously

It is therefore not recommended for employers to ask their staff to participate in a survey by providing their personal data. The best method in this case is an employee survey that is not only voluntary but also anonymous. This satisfies data protection requirements. For employees, this also makes it easier to decide to participate in such a survey and to provide honest answers without concern.

However, the design of the questionnaire must also follow certain principles. It must be designed with a specific purpose in mind, meaning it should not indiscriminately ask for irrelevant information from employees. Furthermore, it must not be possible to identify the specific person based on the answers provided. For example, questions that are too specific regarding the personal background of employees could allow for such conclusions. This would mean the survey is no longer anonymous, as it could lead to identifying a specific individual. The formal execution of an employee survey should also be carefully considered. For instance, filling out multiple-choice questions is clearly preferable to providing handwritten text. In case of doubt, handwriting can be used to link a respondent to a questionnaire. Electronic questionnaires are an adequate way to ensure data protection in employee surveys. However, even here, employers should pay attention to the integrity of the external software provider.

GDPR-compliant design of an employee survey

Conducting an employee survey in accordance with the GDPR is possible, provided that companies observe the following guidelines: 

• Voluntariness: Compelling participation in an employee survey is not covered by law. Employers must clearly communicate this to their staff.
• Anonymity: It must not be possible to draw conclusions about the identity of the person who filled out the respective questionnaire. The formal design of a survey, just like its content, should ensure the anonymity of the respondents.
• Purpose limitation: Especially in small companies, details such as gender or age can provide enough clues to identify employees. Companies should stick to clear objectives and not request unnecessary, overly specific information from their staff.
• Involvement of the Data Protection Officer: To create a GDPR-compliant employee survey, it is advisable to involve the data protection officer in the planning process. Ideally, the choice of an external service provider to conduct the survey should also be discussed with them.
• Involvement of the Works Council: When using technical equipment designed to monitor the performance or behavior of employees, the works council has a right of co-determination under Section 87 (1) No. 6 of the Works Constitution Act (BetrVG). Survey software at least offers the possibility of collecting and recording information on employee behavior or performance. Involving the works council is also recommended to increase acceptance among employees.
• Transparency: Clear and timely communication regarding company surveys builds trust and prevents negative sentiment among employees. Key information to include is the purpose of the survey, how the data will be analyzed, and a note confirming that participation is anonymous and voluntary.

An anonymous employee survey is therefore compliant with data protection regulations. To improve the working environment and gain acceptance among staff, however, employers should also prioritize maximum transparency and involve the works council or data protection officer.