In surveys where both access control and anonymity are an issue, LimeSurvey allows you to anonymize responses. If you choose to do so, then your survey is set to radically anonymize responses - there is really no way to connect answers and participants. Even the admin can't link response data and participant/token data. However you will always be able to specifically view each response entered by your participants in the survey. Thus individual, but anonymous, statistics is still possible to do. Attention:: If this feature is activated the response submission date and the token completed date are always set to 1980-01-01 00:00, no matter of other settings. Why? Invalidating the submission date ensures no match with webserver logs where the token key might show up when a survey is started. Invalidating the token completed date makes sure that you can't align the order of submitted responses to the order of the token date/time.
To enable anonymity, open your survey, then hover over the survey properties button and click the general settings link. Click the tokens tab, and enable anonymous responses.