My problem is a peculiar one – we conduct workplace commitment surveys for our clients. So far these have been not anonymous and we have used e-mail as and identifier to link information on the department where respondents work to the data after the survey is competed. This practice is well known to all parties (including respondent), allows certain flexibility (e.g. if client wants an additional report based on occupation instead of department) and there has been no misunderstandings about this practice.

Under GDPR we have run into difficulties – some of our clients interpret regulation so that if we collect personalized data, a log has to be kept of every change in the collected data. This has to be automatic and be capable to log all changes to the responses (not only user made but also possible changes made by survey administrator). It seems to me that there is no LS tool that would log activities in such a detail … or … have I missed something?

The perfectly acceptable alternative for our clients is a solution where we do not keep data that has a unique identifier of the respondent, but then they want that information on department where the respondent works were prefilled (just adding a question with dropdown list of department names will not do as in the past they have experienced problems with people selecting wrong department name). Also, the survey should keep track on who has responded so that reminders are sent only to those who have not responded. Again – it seems to me that prefilling an anonymised survey from token table is not possible (one could prefill survey with identifier and it would not be anonymous).

So – is there a way to solve my problem with LS? Maybe it would be important to emphasize that the discussion is actually not about anonymity. All we need is a solution that on one hand would allow to prefill question about department where respondent works and on the other hand would automatically remove token/email information from responses table so that it would be impossible for survey administrator to see it (this would solve the need for a detailed log). It would be perfectly ok if survey would not be labelled anonymous – it’s only about storing identifiers.

I’m sorry for such a lengthy problem description, but maybe somebody can suggest a solution for this situation.