Did you know that deleting a pupil’s name from a survey spreadsheet may still leave enough clues to identify that pupil? A row saying “the only new student in a tiny robotics club who travels by a particular bus route” could reveal more than a name column. The surprising part is that the spreadsheet might already have been described as anonymous.
Here is the useful distinction. Anonymous data cannot reasonably be linked to an identifiable person in the relevant circumstances. Pseudonymous data replaces direct identifiers with codes but may still be linkable through a separate key or other information. Confidential data is information whose access is restricted or whose recipients have promised to protect it; it need not be anonymous. De-identified data has had direct identifiers removed or obscured but may still be re-identifiable. These are not interchangeable labels, and each one changes what a school survey team can safely claim.
This is an especially useful vocabulary lesson for pupils creating class projects, secondary students analysing small samples, and adults helping with research. It connects English reading comprehension to statistical reasoning and responsible digital citizenship. We will not collect real classmates’ private details. Every survey and person in the examples below is fictional.
One survey, four very different promises
Imagine a hypothetical class wants to understand where pupils find quiet reading space. It drafts an online form that asks for name, class, bus route, library-use frequency and a free-text explanation. The class project team says, “It’s confidential, so nobody can be identified.” That conclusion does not follow. The form directly requests names. Confidentiality concerns who may see the records and how they are protected; it does not remove the connection to named people.
Suppose the team next deletes the name column. The resulting file has been de-identified in one simple sense: the most obvious direct identifier has been removed. But if someone knows that only one pupil is in a small club or takes a very specific route, the remaining combination may point to that pupil. The words “name removed” are accurate; the word “anonymous” requires further risk assessment.
Now the teacher gives each respondent a random code—R001, R002 and so on—and stores the code-to-name list separately for authorised follow-up. This is a pseudonymisation method. Pseudonyms can reduce exposure during everyday analysis, but the code key still connects rows with people. A claim of full anonymity would be misleading while that link remains reasonably available.
In a final alternative, an authorised analyst prepares aggregated results, strips or groups identifying details, evaluates whether combinations could reveal individuals, and shares only appropriately risk-assessed summaries. That process may produce anonymised results for an intended sharing context, but even then no blanket guarantee should be made without considering who else could combine them with other data. Anonymisation is an evaluated condition and risk-management process, not a magic spreadsheet button.
What does the Singapore regulator mean by de-identification?
Singapore’s Personal Data Protection Commission (PDPC) guide to basic anonymisation discusses techniques for structured data and a workflow for reducing disclosure risks. Its guidance distinguishes de-identification from stronger claims about anonymity. In the PDPC’s advisory guidance, removing direct identifiers is not, by itself, enough to establish that a person cannot be re-identified through other available information.
Another useful Singapore reference comes from Nanyang Technological University’s research guidance on anonymisation. NTU explains why datasets may still need protection when research teams possess a key or other linkage that can identify participants. A key held under appropriate controls may reduce the risk for some users, but it does not make the underlying connection cease to exist.
These sources describe responsible data practices; they do not give pupils a licence to collect information outside school rules. Actual legal and institutional duties depend on the organisation, the people involved and the intended use. A class activity should be approved and appropriately designed, and sensitive personal information should not be gathered merely to make an exercise feel realistic.
The word families reveal the different jobs
Anonymous is an adjective: an anonymous response. Anonymity is the noun: protect anonymity. Anonymise is the verb: anonymise a dataset. Anonymisation names the process. In a careful sentence, we might write: “The analyst assessed re-identification risk before describing the shared summary as anonymised.” It is stronger and more accurate than “We removed one column, so it is private.”
Pseudonym is a substitute name or identifier. Pseudonymous describes information under that identifier. Pseudonymise means replacing or separating identifiers under a particular method. A useful collocation is pseudonymisation key: a mapping that can restore the connection between code and identity. Keep the word key conceptually separate from an encryption key; a simple mapping table is enough to re-identify people if it is accessible.
Confidential is an adjective describing restricted or protected information; confidentiality is the noun. A school may say “The teacher will treat responses confidentially,” meaning access and use are controlled, without promising that nobody knows who answered. Confidentiality is about permitted handling. Anonymity is about whether identity can be established. These commitments can coexist, but they answer different questions.
Why “private” is not precise enough
In ordinary conversation, private might mean secret, personal, protected, not publicly available, or visible only to a small group. In a survey notice, that flexibility can become a problem. A pupil who reads “This is private” might assume teachers cannot connect responses to names, while the form actually records school logins. A better notice names what is collected, who can view it, and how results will be reported.
A reader should distinguish a privacy-setting label such as “Only organiser can view responses” from a data-characteristic label such as “This response is anonymous.” An access control can stop an unauthorised visitor opening the file, but cannot remove identifiers already inside it. Precise words prevent a false promise.
How re-identification happens without a name
A direct identifier is information such as an identifiable full name or personal contact detail. An indirect identifier is a characteristic that may not be unique alone but may identify someone when combined with others. In a large anonymous hypothetical dataset, “age 13” might describe hundreds of people. In a class with twelve respondents, “age 13, only new student, unique after-school activity” could be far more revealing.
The important mechanism is linkage. Imagine an external observer knows a pupil’s public competition result and club membership. A published survey row contains precisely those unusual characteristics. Even without a name column, the outside facts may help the observer match the row to a person. The risk depends on the information available to an actual recipient, not on the good intentions of the pupil who deleted the names.
There is also a trap in free-text answers. A pupil might write, “I read in the library because I wait for my cousin’s training every Thursday.” If a recipient knows whose cousin trains on Thursday, the sentence may contain a clue even after the form removes structured personal fields. A responsible school activity avoids soliciting unnecessarily identifying stories and reviews free-text material before sharing it.
A worked class project with honest labels
Consider a fictional survey of 24 pupils about preferred reading times. The team collects only a choice of morning, afternoon or evening and does not ask for names, class IDs or sign-in details. Suppose the results are 6 morning, 10 afternoon and 8 evening. The arithmetic proportions are 6/24 = 25%, 10/24 ≈ 41.7% and 8/24 ≈ 33.3%. These are invented counts for calculation practice, not real student outcomes.
Can we announce that the responses are completely anonymous? Not automatically. We would still need to know whether the form platform records account identifiers, timestamps, network information or other accessible details, and whether the intended audience could infer identity. But we can accurately report that this illustrative questionnaire did not request names. This is a narrower statement grounded in what the form visibly did.
If the team publishes only the three aggregate counts, it should still consider the audience and sample size. Imagine a separate question about an activity that only one pupil reports. The team should ask whether displaying that subgroup alongside other facts could expose the respondent. Averages and charts are not automatically anonymous simply because they no longer look like individual responses.
Now imagine a different fictional study needs to invite a pupil for a voluntary follow-up. It uses random identifiers and retains a securely separated link to contact details for authorised researchers. The correct description is pseudonymised responses with controlled linkage, not “completely anonymous follow-ups”. The design has a legitimate reason for retaining a route back to participants, and the words should make that reason visible.
The English comprehension skill: read what was actually promised
Look closely at four short statements. “We will not ask for your name” does not rule out other identifiers. “We will report only grouped results” describes an output choice, not necessarily the information held before analysis. “Your answers will be confidential” describes handling commitments but not the removal of identity. “You may withdraw before a specified stage” describes a right or procedure that needs its own precise conditions. None of these sentences can be replaced with “nobody can ever know it was you” without further evidence.
For secondary English, pupils can practise distinguishing claim, evidence, qualification and inference. For Mathematics, they can practise keeping a sample size attached to counts and percentages. For Science, the distinction matters when reporting small observations from a classroom experiment. For future work, the same vocabulary appears in employee feedback, public research and customer surveys.
A diagnostic exercise with answers
Situation A. A teacher records names and responses in a restricted spreadsheet accessible only to the teacher. Is it anonymous? No. It is identifiable information with restricted access. The appropriate description might be confidential handling if the stated protection is in place.
Situation B. A questionnaire gives pupils random IDs, and a protected table links each ID to a name. Is it pseudonymous? Yes, in this illustrative arrangement. It is not automatically anonymous because re-identification remains possible through the table.
Situation C. A team deletes names but includes an unusual competition, a unique club role and a precise date. May it safely call the result anonymous? Not without a further assessment. Indirect clues could be combined to identify someone.
Situation D. A report shows only suitably aggregated results after an appropriate risk review. Does that always make every future use safe? No. The risk depends on the information, recipients, potential linkage and new data that may become available.
Retrieval practice that goes beyond memorising definitions
Cover the answers, then complete these four prompts. A name is replaced with R17 while a teacher keeps the mapping: ______. A spreadsheet is restricted to authorised staff: ______ handling. A row has had a direct identifier removed but may still be linkable: ______. A properly assessed dataset is not reasonably identifiable in the relevant setting: ______. Answers: pseudonymous; confidential; de-identified; anonymous or anonymised, subject to the stated assessment.
Repeat the exercise a week later using a different context, such as a club-feedback form or fictional workplace survey. The aim is not to recall four definitions only. It is to identify what information is stored, who can access it, and whether a route back to identity remains. If pupils can ask those questions, they can transfer the vocabulary into new situations.
What students, teachers and parents can do
A student designing a project should begin with data minimisation: ask only the questions necessary for the learning aim, not every interesting question. If the project simply needs the class’s preferred reading time, a real name, address or contact number is usually unnecessary for that stated purpose. Use teacher-approved tools and follow school rules rather than invent a personal survey service.
A teacher can model a safe exercise using fictional response cards, never actual classmate records. First show a named card, then a coded card with a key, then a suitably grouped summary. Ask pupils to justify each description. Explain that a protected answer sheet remains identifiable if names are still available; access restrictions and anonymisation are complementary, not substitutes.
Parents can ask what a form collects, who may view the responses, whether login or metadata is retained, and whether the results will be shared publicly. A child need not be frightened by every questionnaire, but a vague label such as “private” deserves a clear explanation. When uncertain, follow the school’s established process rather than sending personal material to an unapproved destination.
Common mistakes and better corrections
Mistake: “Names deleted means anonymous.” Better: “Names were removed; indirect identifiers and re-identification risk still require review.” Mistake: “A code makes data safe for public posting.” Better: “A code can reduce direct exposure, but the mapping and other linkable details must be controlled.”
Mistake: “Confidential means nobody knows whose answer it is.” Better: “Confidential means information is handled under access and use restrictions.” Mistake: “Grouped charts can never reveal an individual.” Better: “Small subgroups and combined tables may still expose identity.” Words make each correction clearer than a blanket promise of protection.
Frequently asked questions
Can an anonymous questionnaire still use an online form? Potentially, but do not assume that selecting “do not collect names” disables every possible identifier. Check the actual collection settings and the platform’s handling in the intended context.
Are pseudonyms just fake names? In a data-management setting a pseudonym can be a random code. If a link to the real identity exists, that link must be considered when describing the data.
Is confidential information automatically encrypted? No. Confidentiality describes an access or handling obligation. Encryption is one possible technical control, but the two terms are not synonyms.
Does a class need to publish its raw survey spreadsheet? Not simply to demonstrate a Mathematics calculation. A fictional or appropriately assessed aggregate can often explain the method without exposing individual answers.
What about school policies and the law? Use the current policies and authorised staff processes that apply to the actual situation. This educational guide is not an individual legal determination or permission to collect student records.
Why the distinction stays useful into adulthood
The deepest lesson is that labels carry obligations. Anonymous makes a claim about identifiability. Pseudonymous acknowledges a substituted identity and possible link. Confidential describes protected handling. De-identified describes a step that may be incomplete. By choosing the correct word, students learn to respect what data can reveal and what a promise really means.
Continue with the verified Vocabulary Learning Hub for broader English vocabulary, or with How Education Works: Privacy-Safe Education Reporting for a systems-level extension. References reviewed 29 October 2026: Singapore PDPC Basic Anonymisation and NTU research data anonymisation guidance. Fictional class records and calculations are teaching examples only.