What's the best way of anonymising data collected in Microsoft Forms

DDHub  At my company we regularly use a combination of Forms, Power Automate and SharePoint lists to collect sensitive information from our staff that only a very small number of people should see, and the data shouldn't be stored in Forms for longer than absolutely necessary. We do this as follows:

• the user submits the form in Microsoft Forms. Because the user is internal to our organisation the form already knows who they are from their Office 365 login.
• a flow in Power Automate saves that response into an "open" list in SharePoint. Everyone will need Contribute permissions for that list.
• the next action in the flow is to copy that list item to a "secure" list where the permissions are heavily locked down.
• the final action in the flow is to delete the item from the "open" list.

The flow actions run so quickly that no-one can ever see any items in the "open" list: SharePoint has created then deleted the item before the list has time to refresh. Additionally, because a user can only see items in the site recycle bin that they deleted they can't go into it and restore items as they were deleted as part of the flow and were therefore deleted by the flow owner.

The flow will record their email address but you need that so you know how to contact them and to track their progress. But as this is stored in the secure list it's not a problem. And the data is being held for the specific reason that the user submitted the form and is therefore compliant with (in my area of Europe anyway) GDPR.

A separate flow runs every 1 hour each day to delete all responses in the spreadsheet behind the form.

Rob
Los Gallardos
Microsoft Power Automate Community Super User