Small number suppression in recurring public reports and dashboards

Reference article · 6 min read

A monthly dashboard broken out by neighborhood, school, age band, or race can be useful and still expose individuals. The risk is rarely one dramatic disclosure. It accumulates: a cell holding a count of one, a total that lets a reader subtract the rest of the row, and a release a month later that lets the same reader difference the two.

Recurring reporting is harder than a one-time release, which can be reviewed by hand before it goes out. A dashboard refreshed monthly across dozens of geographies and demographic splits cannot be. The suppression rule has to be written down, encoded in the pipeline, and applied identically every cycle, including to corrections and backfills.

Choose a threshold and define what it applies to

The threshold is the smallest count the agency is willing to publish.

• Legal and program floors. Student data, health data, juvenile records, and many federally funded programs carry confidentiality obligations or grant conditions bearing on published figures. Requirements differ by program and state and they change, so confirm the current one with the program office, the funder, and your counsel rather than copying another agency's number.
• Sensitivity of the attribute. A count of library program participants does not carry the risk of a count in a behavioral health or domestic violence category. Agencies commonly set a higher threshold for sensitive attributes.
• Unit of analysis. Decide whether you are counting people, events, or records, and drive suppression off distinct individuals, because ten calls for service can involve one person. Apply the threshold to denominators as well, since a rate built on a tiny base identifies people even when the numerator looks safe.

Use complementary suppression so totals cannot give the cell back

Primary suppression hides cells below the threshold. If a row also publishes a total, a reader subtracts the visible cells and recovers the hidden one. Complementary suppression hides additional cells so the arithmetic no longer closes.

• If exactly one cell in a row or column is suppressed, suppress at least one more in it. Check both dimensions: a cell can be protected across its row and exposed down its column.
• Watch nested geography and related reports. A citywide total plus every neighborhood but one reveals that neighborhood, and the same population broken down two ways can be recombined.
• Pick complementary cells by a documented rule, such as the next smallest value in the row, so results are reproducible rather than analyst-dependent.

Consider rounding, ranges, and aggregation before blanking

• Controlled rounding. Round every cell to a base such as five or ten, not only the small ones. Rounded rows may not sum to rounded totals; say so in the notes.
• Ranges. Publishing "fewer than 10" preserves information and avoids an empty grid.
• Aggregation. Combine categories or geographies, or lengthen the window to a rolling twelve months. For a monthly dashboard this is often the most honest fix, because it yields stable figures instead of a screen of asterisks.

Do not mix methods inside one table; rounding some cells while suppressing others can reveal what was hidden.

Decide how zeros are handled

Zero is a true count and also a disclosure: it tells the reader that nobody in a category has the attribute. Either treatment can be defended, but choose one and document it.

• If you publish zeros while suppressing small counts, readers learn that every suppressed cell falls between one and the threshold minus one. That is usually acceptable, but say so in the notes.
• Use distinct symbols, with a legend, for suppressed, zero, not collected, and not applicable. Collapsing these into one dash invites misreading.

Protect against differencing between releases

• Corrections and restatements. A cell suppressed one month and published the next, for a period whose underlying value has not changed, discloses the original figure. Once a period is suppressed, keep it suppressed.
• Cumulative and rolling figures. Subtracting consecutive year-to-date totals produces the period count. Apply the threshold to those differences, not only to the cells you print.
• Changing categories. A new breakout introduced mid-year lets readers compare old and new versions of the same population. Reissue prior periods under the new scheme, or hold the change for a new reporting year.
• Archives. Prior releases stay online. Test each new release against what is already public, not only against itself.

Write the rule down and publish the plain-language version

Maintain a short suppression policy covering the threshold and its rationale, the data domains covered, the unit of analysis, the complementary rule, the rounding or range convention, zero handling, legend text, who may approve an exception, and a version with an effective date. Publish the threshold and the general method, which helps users read the figures correctly, and keep cell-level decisions internal. A written rule is what keeps figures consistent between releases and stops case-by-case calls that quietly differ.

Build it into the system, and what to ask a vendor

Apply suppression in the data layer, upstream of the visualization, so charts, exports, printed reports, and APIs all inherit it. A tool that suppresses only at the chart level leaks through a CSV download or a direct query. Because users filter, evaluation has to happen at query time: a filter combination can produce a count of one when the default view is safe.

Ask a prospective vendor to:

• Demonstrate suppression on your data, using a filter combination that produces a count of one, then export that view.
• Show the same behavior in every output path, including API responses, scheduled reports, and open data feeds.
• Explain whether the rule is configuration or code, who can change it, whether changes are logged, and how unsuppressed data is restricted in caches, logs, and vendor support access.

In the contract, name the rule as a requirement rather than a preference, require the tested behavior across exports and APIs, and require regression tests for edge cases the agency supplies. HQT works with state and local government agencies on data platforms and public reporting, including how disclosure rules are implemented and tested in the systems that produce the numbers.

Frequently asked questions