In surveys where both access control and anonymity are an issue, LimeSurvey allows you to anonymize responses. If you choose to do so, then your survey is set to radically anonymize responses - there is really no way to connect answers and participants. Even the admin can't link response data and participant/token data. However you will always be able to specifically view each response entered by your participants in the survey. Thus individual, but anonymous, statistics is still possible to do.
To enable anonymity, open your survey, then hover over the survey properties button and click the general settings link. Click the tokens tab, and enable anonymous responses.
LimeSurvey will not store any information that can link the response to a person. Note that as the information is not stored at all, no one, not even the server administrator, can recover this information later. For example, if this feature is activated the response submission date and the token completed date are always set to 1980-01-01 00:00, no matter of other settings. Why? Invalidating the submission date ensures no match with webserver logs where the token key might show up when a survey is started. Invalidating the token completed date makes sure that you can't align the order of submitted responses to the order of the token date/time.
Important: Even though LimeSurvey doesn’t save identifiable information, it doesn’t mean that you can’t! If your survey contains the question “What is your name?”, it is obviously not anonymous. LimeSurvey has no way to know what the content and context of your questions is, and will allow you to ask these kind of questions even when the survey is set to be anonymous. Ensuring anonymous and confidential data collection is always your responsibility, LimeSurvey just tries to make it easier for you.
Yes and no.
You can still use tokens for mass-mailing respondents with invitations and reminders. While LimeSurvey isn’t aware of what response belongs to which respondent, it is aware that a particular respondent has completed the survey.
You can not use other data available in tokens in the survey; you can’t use tailoring and/or routing with token attributes, nor can you store token attributes in the final data set.
The most important implication of this is that anonymous surveys are possible for the vast majority of ‘single shot’ surveys. The anonymous mode is less suitable in a situation where you would need to link respondents to responses directly, for example to track responses over time in a longitudinal setting.