Did you know that deleting names from a survey spreadsheet does not automatically make the students anonymous? A class might replace “Mei” with “Student 07” and leave enough clues for classmates to work out who answered a question.
The useful distinction is this: pseudonymised records use substitute identifiers that may still link back to people; aggregated results combine information into groups or statistics; and anonymised data has been processed and assessed so that individuals are not identifiable in the relevant circumstances. Aggregation can help, but it does not automatically establish anonymity. Knowing exactly which term applies protects classmates and prevents careless claims about privacy.
A fictional Secondary 2 journey-to-school survey
Imagine 24 fictional Secondary 2 pupils answering a teacher-approved question about how they usually travel to school. Eight report walking, ten report public transport and six report another arrangement. Those groups total 24. This is an invented example for teaching, not a description of an actual eduKateSG class or a claim about Singapore pupils.
The original worksheet has names, classes, travel modes and exact journeys. The teacher replaces names with codes P01, P02 and P03, then keeps a separate list matching each code to a student. Someone who sees only the coded table may not see a name, but a person with that key can still identify a pupil. A distinctive answer, such as one unusually long journey in a small class, might reveal someone even without the key.
Next, the class draws a bar chart: walk 8; public transport 10; other 6. That chart is aggregated. It answers a question about transport patterns without listing 24 named records. But a group of one person, or a combination of unique details, can sometimes identify an individual. A group total is not a magic privacy shield.
A vocabulary fence: seven terms that must not blur together
- Identifier: information that identifies a person directly, or that can identify the person when combined with other information. A name is a common direct identifier.
- Indirect identifier: a detail that may be identifying in combination with others, such as a rare role, exact route or unusually specific date in a small group.
- Pseudonym: a substitute code or name standing in for an individual’s real identity. “P07” can be a pseudonym.
- Pseudonymisation: the practice of replacing or transforming identifying labels while some means or possibility of linking the record to a person remains.
- Aggregation: the act of combining individual records into totals, averages or categories. A class count of ten travellers is an aggregate result.
- Anonymisation: processing and safeguards intended to reduce identifiability, evaluated in light of who receives the data and what information can be combined with it.
- Re-identification: discovering whom a transformed record refers to, often by using a linking key or another set of clues.
- Disclosure: making information available to someone. A teacher-only file and a publicly shared school newsletter are different disclosures.
Useful word families include identify → identity → identifier → re-identification, anonymous → anonymity → anonymise → anonymisation, and aggregate → aggregated → aggregation. Common phrases include coded responses, grouped results, small-cell risk and separate mapping key. Replace the vague “the data is safe” with a testable description such as “the public chart contains grouped results, and the teacher reviewed possible identifying details.”
One question, three very different versions of the data
Version A: a named response
A row reads: “Amina, 2B, public transport, 42 minutes.” The name directly identifies the respondent. A chart comparing transport methods does not ordinarily require that named row to be displayed. A teacher may retain necessary detailed records within an approved access process while using only relevant summary data in the presentation.
Version B: a coded response
A row reads: “P06, 2B, public transport, 42 minutes.” The direct name has gone, but the student can still be identified if someone has the matching key or enough background information. Describing this simple change as pseudonymisation is generally more precise than automatically calling the result “anonymous.”
Version C: a group statistic
A slide reads: “Of 24 fictional respondents, ten reported public transport.” This is an aggregated statement about a group. It omits individual routes and names. Whether the release is sufficiently anonymised still depends on the complete dataset, the group sizes, the people who can see it and what else they know.
Why context matters more than the appearance of a spreadsheet
A large dataset about general commuting habits may be presented through broad categories. A four-pupil group describing a rare activity may be identifiable even when names are hidden. Combining a coded list with a photo, a timetable or a small class roster can reveal more than any one file on its own. Privacy analysis therefore considers the audience and the possibility of linking datasets—not only whether a “Name” column is visible.
Singapore’s Personal Data Protection Commission guide to basic anonymisation explains a structured approach to de-identification and risk reduction. The National Institute of Education guide to data anonymisation also discusses pseudonymisation, aggregation and the challenges of recordings. These are trustworthy starting points, not a declaration that a particular class survey satisfies every applicable legal or school requirement.
Real school data collection must comply with the school’s procedures, permissions and relevant responsibilities. Pupils should not upload classmates’ personal answers to a public AI tool or open website simply because a student code replaced each name. If unsure whether the information can be shared, ask the supervising teacher.
A practical decision routine for parents, teachers and students
- Clarify the purpose. Are individual journeys necessary to answer the research question, or will category totals do?
- Review direct identifiers such as names and indirect clues such as rare combinations of details.
- Choose the audience before preparing the output. A class teacher, a research team and the general public do not need identical levels of detail.
- Minimise information. Avoid collecting exact personal details that the investigation does not require.
- Check all totals and denominators. Eight plus ten plus six equals 24 in our fictional example. Do not quietly omit unanswered questions or describe respondents as all students at the school.
- Ask the teacher or responsible data owner to review the proposed release and possible re-identification risk.
The sixth step joins Mathematics and language. A pupil must understand what a sample is, what a total includes and what a proportion represents. In this invented dataset, 10 out of 24 respondents chose public transport; that fraction describes the respondents, not the commuting habits of all Singapore students. The words surveyed group and whole population prevent overgeneralisation.
Spot the misconception before it becomes a mistake
Ask a Secondary 1–3 learner: “If a spreadsheet says P01, is it anonymous?” A strong answer is “not necessarily; a linking key or other clues can identify P01.” Ask: “If a table contains one person in a category, is a category count always safe?” The answer is again “not automatically.” Ask: “Is an average as detailed as all 24 original answers?” No—aggregation changes what can be studied as well as what can be revealed.
For a retrieval exercise the next day, show three imaginary files: a named attendance list, a coded research sheet, and a chart of anonymous-sounding group counts. Have the learner label what each format actually shows, then explain what cannot yet be concluded about privacy. For transfer, use a different approved or fictional topic such as reading preferences, sport participation or plant observations. Students should learn the mechanism, not memorise one travel chart.
Where this vocabulary leads in the 21st century
In Primary Science a child begins with simple recording and grouping. Secondary Mathematics and Science ask students to represent measurements fairly and interpret charts. English lessons ask them to explain claims without overstating evidence. Later, public health, social research, business, data science and public service all demand careful distinctions between individually linked data and shareable summaries. That progression works across different school subject levels without assuming one G1, G2 or G3 pathway defines a child’s capability.
An everyday parallel is a photo. A picture may have no name written on it yet still expose a place or person. EduKateSG’s guide on checking photo GPS metadata before sharing explores a different kind of identifying clue. For more vocabulary connections, see the master vocabulary hub. These are complementary lessons, not substitutes for privacy review.
Frequently asked questions
Does replacing names with numbers make a survey safe to post publicly?
No. Codes can still link to identities, and other details may identify participants. The release needs an appropriate review of purpose, audience, potential re-identification and the applicable permissions.
Does grouping data automatically make it anonymous?
No. Tiny categories, rare combinations and outside information can still expose people in some contexts. Aggregation often helps reduce detail, but anonymity is a separate conclusion.
Should students stop doing surveys?
Not at all. An approved, well-designed survey can teach useful enquiry, Mathematics and communication. The lesson is to gather what is necessary and to share results with care.
A precise word is a practical safeguard. “We pseudonymised the responses” tells readers more than “we hid the names”; “we aggregated the results” explains what happened to the rows; and “we reviewed re-identification risk” describes the question that still has to be answered. All people, counts and survey findings in this article are fictional educational examples; this article is not legal advice.