Review a public aggregate without assuming small cells are anonymous

Choose the useful public statement before the table

A creator may want to explain which reporting questions a workshop raised without revealing an attendee or organization’s private problem. Define that useful statement, the actual permission and the minimum needed detail. Do not start by publishing every column simply because the source spreadsheet can export them.

The Government Analysis Function’s disclosure guidance balances utility and confidentiality and varies by data/context. Its official-statistics rules are not a universal threshold for creator reports. This guide uses wholly constructed exact counts to explain a mechanical risk, not to certify a legal or anonymous release.

Inspect cells, margins and other releases together

For exact unweighted counts, hiding a cell while publishing its total and every other component can disclose the hidden value by subtraction. Some tables require additional suppression or a different design to avoid that particular reconstruction. Different weighted or perturbed data require their own assessment; do not apply one recipe blindly.

Also inspect earlier reports, overlapping category definitions and public downloads. A suppressed value in one view can appear in another, and a new table may reveal a difference absent from either table alone. Keep the proposed release set and relevant previous versions in the review.

Consider what the reader may already know

A role, small group, date or known participation can make an otherwise unnamed record recognizable. Aggregation does not automatically remove that context. Keep identity disclosure, attribute disclosure and permission separate: a fact can be inappropriate to reveal even when you omit a name.

Prefer a broader allowed statement or omit an unnecessary breakdown when it serves the reader’s task. If you coarsen categories, explain what the new group means and keep that definition consistent. Do not label a chosen group size a guarantee against every other source or future release.

Resolve three constructed public-release decisions

D1 — Constructed exact table: category counts 6,3,1 and total 10. Hiding only the last cell still gives 10−6−3=1. Decision: redesign the allowed output, such as a justified coarser grouping, additional suppression or no breakdown. Outcome: the single-cell hiding fails; no alternative is certified safe without context.

D2 — Constructed linked releases: a full selected set has six positive outcomes; another release excluding one publicly known unit has five. Their difference reveals that unit’s outcome. Decision: review the linked outputs together and hold or redesign the proposed detail. Outcome: removing names from each table alone did not resolve the disclosure.

D3 — Constructed download mismatch: a public chart shows only broad totals but its linked workbook includes named source rows. Decision: hold that workbook and create an actually authorized minimal derivative if appropriate. Outcome: the public release includes attachments, not just the visible graphic; a correct sum does not grant sharing permission.

Check the actual files and bounded explanation

Inspect the saved public artifact, supporting text, alt text, table, CSV/JSON and links as one set. A later edit can reintroduce a suppressed number in a caption or total. Preserve the review version so a new export is not assumed safe merely because it shares a filename.

If output values are rounded, suppressed or otherwise transformed, label that treatment without disclosing the protected value elsewhere. Explain material interpretation limits. Do not advertise a made-up universal anonymity test, a guaranteed safe minimum group size or the ability to identify people behind native platform aggregates.

Keep an explicit publish, coarsen or hold decision

The worksheet keeps purpose, authority, source/unit, proposed table and attachments, totals/linked releases, relevant context, chosen transformation and final checked version. It permits a clear hold. Completed source notes remain private and the public packet uses no real personal data.

Primary disclosure guidance was read on 1 November 2026 in the relevant risk, suppression and linked-table sections. All examples are constructed; this workflow neither certifies anonymity/compliance nor publishes a real dataset.