K-anonymity at k = 50GSS guidance · ONS small-number suppressionNo published number represents fewer than 50 students.
If a cohort is too small, the data is suppressed entirely. The GSS administrative-data baseline is k=5 to k=10. ONS small-number suppression starts at cells under 3. We use 50 because this is mental-health data about children, not census tables.
Differential privacy at ε = 1.0UKSA EAP215 · Gaussian mechanismCalibrated Gaussian noise injected before any number leaves the pipeline.
Smaller cohorts get more noise. Counts, percentages, and scores are all noised. UK Statistics Authority EAP215 (Dec 2024) treats ε ≤ 1 as strong protection; we sit at the conservative end of the published range. Quantisation is applied before noise so true values are not recoverable.
Four-week rolling smoothingDifferential privacy literature · ONS smoothingEvery published score is a four-week rolling average.
A point-in-time snapshot would be both noisier and more re-identifying. The rolling average reflects how wellbeing actually moves and prevents differencing attacks where someone subtracts one week from the next to isolate a single contribution.
Cell suppression with hysteresisDisclosure-control side-channel mitigationA cell that drops below k=50 stays suppressed for three weeks.
Without hysteresis, a cell flickering across the suppression threshold would itself become a side channel. The three-week hold prevents week-to-week presence/absence inferences. Suppressed cells return null, not a blank, so you cannot infer membership from gaps.
Cross-tabulation limitDisclosure-control standard practiceNo more than three dimensions can be combined in any query.
Cross-tabs combinatorially shrink cell sizes. Capping at three dimensions (e.g. region × institution-type × week) keeps every published cell above the k=50 floor. Deeper splits would force suppression of nearly everything.
Open methodology documentOSR Code of Practice · TrustworthinessThe live methodology JSON is publicly served by the API.
GET /v1/pulse/methodology returns a versioned, machine-readable description of every parameter. This page is the plain-language counterpart. If they ever diverge, the API is the source of truth.