Guide to Reporting Unidentified or Missed Sensitive Data

Topics:

Qualtrics Topics
Qualtrics CX Topics
Qualtrics Guides and Best Practices Topics
Back to top

Heads Up

Back to top

Why This Policy Exists

40:33 - Sensitive Data Policy

People filling out a form do not always stop to think about what they are sharing. A simple Contact Us form is a good example: it might only ask for a name and a message, but a constituent can still type in far more than that, a Social Security number, a date of birth, a home address, anything they think will help their case. None of that was asked for, and none of it needs to sit in a survey response.

That is exactly the kind of data this policy is built to catch. When it shows up, it gets redacted, because protecting that information matters more than keeping the raw response intact.

Back to top

What Is the Sensitive Data Policy?

40:33 - Sensitive Data Policy

The Sensitive Data Policy is a built-in Qualtrics check for certain kinds of personal information, like Social Security numbers and Tax IDs. That’s why the Choose Your Path form asks about things like 8-digit or 12-to-26-digit numbers, and why the Issues and Tips panel warns you when a question gets flagged. The goal is to catch as much as possible before a survey goes live, so the after-the-fact reporting covered in this guide is the exception, not the rule.

Back to top

Important Note

40:33 - Sensitive Data Policy

Once a redaction happens, it can't be undone. If you spot a risk, report it right away - the sooner we know, the sooner we can stop it before anything gets redacted.

A flagged survey response reading ‘Hello, I love the form, here’s my real social security number’ with the actual number redacted and replaced by asterisks, and a red warning triangle marking the response.
Back to top

If You Find It First

40:33 - Sensitive Data Policy

If you find red triangles like the ones in the screenshot above while reviewing your data analysis, and it hasn't already been added to the exception list:

  • Open a ServiceDesk Plus request to report it.
  • Our team reviews your report and schedules a short meeting with you to discuss next steps and outline an action plan.
Back to top

If We Find It First

40:33 - Sensitive Data Policy

From time to time, our team runs a data steward audit across live surveys. If that audit flags sensitive data in your survey that hasn't been exempted:

  • You'll get an email letting you know what was found and that it's been added to the exception list for now.
  • Any new responses that fall into this category are no longer redacted while the exception is in place.
  • You'll receive an invite to a short meeting (typically 15 minutes) with the Qualtrics team to go over what was found and agree on next steps.

Either way, you're covered. The exception list keeps things moving while we sort it out, and the follow-up meeting is just a conversation to figure out next steps, not a penalty.

Back to top

What Happens After

40:33 - Sensitive Data Policy

The goal of these meetings is the same either way: understand why the data showed up, confirm whether it needs a permanent exception or needs to be removed, and make sure your survey stays compliant going forward.

Back to top

Want to Learn More? Find Out What's Going On

40:33 - Sensitive Data Policy

Locating Sensitive Data Policy Violations

Either you spot the red triangle yourself while reviewing your data, or it gets reported to you after our team finds it during a routine audit. Either way, the response has already been flagged, it just comes down to who notices it first.

  • In the Data & Analysis tab, click Column chooser.
  • In the dropdown, go to Embedded Data.
  • Check the box next to Q_DataPolicyViolations.

A new column appears in your data table showing the specific policy fields flagged for each response, for example USA Social Security Number or USA Tax ID, right next to the red warning triangle. This tells you precisely what tripped the alert, instead of just that something did.

Three steps to add the Q_DataPolicyViolations column: click Column chooser, open Embedded Data, then check Q_DataPolicyViolations. The resulting column shows which policy field, like USA Social Security Number or USA Tax ID, triggered each red warning triangle.

Filtering Sensitive Data Violations

A flagged response looks like this: the response text itself, with a red warning triangle on the right. For example, someone might write Hello, I love the form, here's my real social security number: ********* right in an open text field. There are two ways to locate and filter for responses like this.

Option 1: Filter by sensitive data

  • Click the Add Filter dropdown.
  • Select ExpertReview: sensitive data from the list.

Option 2: Click the red triangle directly

  • Click the red warning triangle icon next to a flagged response.
  • In the Quality Issues popup, under Sensitive Data, click View All Sensitive Data Violations to see every flagged response at once.
A flagged response showing a red warning triangle, with two ways to review it: filtering by ExpertReview: sensitive data under Add Filter, or clicking the triangle directly to open Quality Issues and select View All Sensitive Data Violations.
Back to top

An Alert System Is on the Way

40:33 - Sensitive Data Policy

Still in scoping and building, not live yet. We're working on a new workflow that will alert you directly when red triangles like these show up in your survey, so you don't have to catch them yourself during a manual review.

Qualtrics workflow named Data Policy Violation Alert, triggered by a survey response, with a decision step checking whether the Embedded Data field Q_DataPolicyViolations isn’t empty, then sending an email notification.
Back to top