Reporting wellbeing without surveillance: the cohort-of-10 rule

There is a version of employee wellbeing measurement that helps people, and a version that quietly frightens them. The difference is rarely the survey questions. It is who can see the answers, and at what resolution. Anonymised employee wellbeing reporting is the discipline that keeps those two versions apart: it lets an organisation read the health of its workforce in aggregate while making it structurally impossible to read any single person.

Get this wrong and the data turns toxic in both directions. Employees who suspect their manager can see their score stop answering honestly, or stop answering at all, so the signal you paid for becomes noise. And an HR team that can drill down to a named individual's anxiety screen is holding sensitive personal data it has no clinical mandate to hold. The fix is not a longer privacy policy. It is a reporting architecture with a hard floor built into it, and the most important number in that architecture is the minimum cohort size.

A minimum reportable cohort is the smallest group for which a result will be shown at all. Below that threshold, the dashboard returns nothing: no average, no trend, no breakdown. Ten is a commonly used floor in workforce and statistical reporting because it makes re-identification impractical without setting the bar so high that smaller teams never see any signal. If a team of forty shows an average wellbeing score, no single person's answer can be reverse-engineered from it. If a team of three shows one, anyone who knows two of the answers can infer the third.

Re-identification rarely needs a name. It needs a small enough group and a few facts a colleague already has. Filter a survey by department, then by location, then by tenure band, and a cohort of two hundred collapses to four people, one of whom just went on leave. That is why the floor has to apply to every slice, not just the headline. The moment any combination of filters drops a group below ten, the result must disappear, not round.

The floor also has to cover the absence of an answer. If nine people in a team of ten respond and the system reports the cohort, the one person who declined is now visible by subtraction. Honest anonymised employee wellbeing reporting suppresses small denominators and conspicuous non-response with equal seriousness.

Anonymity is often framed as a concession to employees, a privacy nicety bolted on at the end. It is closer to the opposite. Anonymity is the measurement condition that makes the data worth collecting at all. Validated screens such as the PHQ-9 for depressive symptoms and the GAD-7 for anxiety symptoms only reflect reality when people answer truthfully, and people answer truthfully when there is no plausible path from their answer back to their performance review.

This is where psychological safety stops being a poster and becomes a data-quality variable. Amy Edmondson's research on psychological safety, and Google's Project Aristotle work on what makes teams effective, both point to the same thing: people share difficult truths only when they believe disclosure is safe. A wellbeing programme that can name names has weakened the precondition for its own accuracy. You will get a clean-looking dashboard full of polite, defensive answers, and you will mistake it for good news.

There is a clinical reason too. A screening score is not a diagnosis, and burnout, which the WHO describes in ICD-11 as energy depletion or exhaustion, mental distance or cynicism toward the job, and reduced professional efficacy, is framed there as an occupational phenomenon rather than a personal failing. Treating an individual's score as a fact about that person, visible to their employer, both misreads the instrument and creates exactly the surveillance dynamic that suppresses honest answers.

India's Digital Personal Data Protection Act, 2023, sets out duties for organisations that act as a data fiduciary over employees' personal data. Wellbeing responses tied to an identifiable person are personal data, and the Act's broad principles of consent, purpose limitation, and data minimisation map closely onto how a wellbeing programme should be built. Collect for a stated purpose, use it only for that purpose, and hold no more identifiable detail than the purpose requires. None of this is legal advice; the point is that good privacy engineering and the Act's principles tend to pull in the same direction.

The cohort floor is data minimisation made operational. If HR only ever needs population-level signal to decide where to invest, then HR should only ever receive population-level signal. Properly aggregated and suppressed reporting moves the output toward data that no longer singles anyone out, which tends to lower both the compliance burden and the breach blast radius. Individual responses, where they exist for a person's own care, should sit with the clinical or counselling provider under its own confidentiality duties, separated from the employer's reporting plane.

Indian workforces add their own re-identification hazards that a generic tool ignores. Shift rosters, small night-shift cohorts, a single-person role in a regional office, or a department thin enough that statutory records like PF and ESIC already imply who is who: each can shrink an apparently safe group below the floor. The reporting design has to know about these structural facts, not just the headcount on paper.

Reporting without surveillance is not a weaker product. It points you at the right intervention faster, because population patterns are where the actionable levers live. If one business unit's exhaustion signal climbs every quarter-end, that is a workload and planning problem you can address with staffing or deadlines, and you do not need a single name to address it. The aggregate tells you where to act; the individual detail would only tell you who to worry about, which is not your job and not your right.

The money follows the same logic. Studies from firms and bodies such as Deloitte on the employer cost of poor mental health, alongside Gallup and SHRM estimates putting the cost of replacing an employee at roughly one-half to two times their annual salary, all describe losses that accumulate at the level of teams and the organisation, not the individual. To put it in local terms, a single mid-level exit can quietly run into several lakhs of rupees once you count hiring, ramp-up, and lost institutional knowledge, though the exact figure varies widely by role. You reduce that by changing the conditions a whole cohort works under, which is precisely what anonymised reporting is built to reveal.

The same raw responses can power a programme people trust or a system people route around. The deciding factors are mechanical and checkable: a hard minimum cohort applied to every slice, suppression of small denominators and visible non-response, separation of the employer's aggregate reporting from any individual clinical record, and a purpose you can state in one plain sentence. None of this requires trusting anyone's good intentions, which is the point. Trust should be built into the architecture, not promised in a deck.

When we built the wellbeing index inside AhaTherapy, the cohort floor was not a setting we exposed as optional. It is the foundation the reporting stands on, because a dashboard that can be filtered down to one person is not a wellbeing tool, it is surveillance with a friendlier colour palette. Ask any provider, including us, to show you the floor, the suppressed slices, and the wall between aggregate and individual. If those three things are real, the insight is honest. If they are not, no privacy policy will make it so.