I was wondering if someone could help me. We run voluntary return-to-work (after training) Kirkpatrick evaluations 3-4 in our organization. We distribute a link to an e-feedback form, but the data collected is anonymous. No email addresses, no person-identifying information, no location identifying information is collected. In other words, it is impossible to definitively connect a single piece of feedback to a natural person. The most that can be generically assumed is someone, at some point, who participated in the training, gave a feedback. The names of the training participants are kept separately from the feedback form.
The question therefore - to what extent do anonymous, voluntary Training feedback evaluations on work performance (Kirkpatrick level 3-4) fall under GDPR?
I did a GDPR audit, and cannot find a single question in the questionnaire that is personal data, since no person is ever referenced. Yet, I cannot believe it is that simple, and I am starting to second guess myself.
Anyone have any tips on this? How have you handled training evaluation? With or without person-identifying information?
Many thanks in advance.