360-degree feedback: how to design one that is useful
By Deibson Silva · Reviewed on
360-degree feedback gathers ratings of one person from several angles: their manager, their peers, the people who report to them and the person themselves. It is useful when it rates observable behaviour defined in advance, protects the anonymity of those who respond, is calibrated before it closes and ends in a development plan agreed with the person.
What is 360-degree feedback and what is it for?
It is a way of rating someone's performance through the eyes of the people who work with them, not just their manager. Each of those viewpoints sees different behaviour: the manager sees results and accountability, peers see collaboration, and direct reports see how the team is led.
It is above all a development tool: it shows the person where their view of themselves matches other people's and where it does not. It also feeds evidence into the performance cycle and the performance axis of the 9-box grid. What it should not be is the only input for decisions on someone's pay or career, because it mixes a development conversation with one about consequences and changes how people answer.
Who rates whom?
That depends on the relationships you include, and each adds something different. The manager's rating should always be there; the others depend on what the cycle is for. With the manager alone it is a 90-degree review; adding the self-assessment makes it 180; adding peers, 270; and adding direct reports, 360.
| Relationship | What it adds | How it is shown to the person rated |
|---|---|---|
| Line manager | Results, commitments and the context of the role | Named |
| Self-assessment | How the person sees themselves | Named |
| Peers | Collaboration, reliability, work across teams | Anonymous and combined, only with enough responses |
| Direct reports | How they lead, delegate and give feedback | Anonymous and combined, only with enough responses |
Which competencies and indicators should you rate?
A few competencies, each described as behaviour that can be observed. A long list tires respondents and produces block ratings: the same score for everything. A handful of competencies, chosen for what the role needs, is usually enough for one cycle.
Each competency is broken down into three, four or five behavioural indicators. "Communicates well" cannot be rated; "sums up decisions in writing at the end of each meeting" can. Every point on the scale needs a label, such as "below expectations" or "meets expectations", so that two people who pick the same number mean the same thing.
Decide before the cycle opens which competencies feed performance and which inform potential. Sorting them after the results are in is the quickest way to make sure nobody trusts the results.
How is anonymity protected?
With two rules: answers from peers and direct reports are always shown combined, and never shown at all without enough responses. When a relationship has very few responses, the prudent course is to merge it with another or hide it; showing it on its own would let people work out who answered.
Written comments need even more care, because style gives people away. With few responses, it is better to summarise the themes than to quote sentences word for word. The self-assessment and the manager's rating are shown named, because everyone knows whose they are.
Anonymity does not clash with the right of access. Article 15 of the GDPR gives each person the right to access the data held about them, and paragraph 4 makes clear that the right to a copy must not adversely affect the rights of others, including those who rated them.
How are results calibrated and fed back?
Calibrate first, then hand over. Before the cycle closes, the leadership team reviews results together to spot anyone who always rates higher or lower than the rest and to adjust what the evidence does not support. Every adjustment is recorded with its reason.
Feedback is a conversation, not an email. The manager sits down with the person and goes through where their self-assessment matches other people's view, where they rate themselves lower than others do, which is a hidden strength, and where they rate themselves higher, which is a blind spot. Two or three dated development actions come out of that conversation.
A 70-20-10 plan, with practice on the job, learning from other people and formal training, is a simple way to turn those actions into a commitment signed by the person and their manager.
What does data protection require?
Information up front, the minimum of data and a person who decides. Before starting, staff must be told what the review is for, who will see the results and how long they will be kept (Article 13 of the GDPR), and no more should be collected than the purpose needs (Article 5).
In Spain, the data protection authority's list of processing that requires an impact assessment expressly mentions evaluating work performance, personality and behaviour; when processing meets that criterion and another on the list, such as large-scale data, an impact assessment is needed in most cases.
If a decision affecting the person depends on the 360, Article 22 of the GDPR prevents it from resting solely on an automated calculation; the Spanish authority's guide on employment reminds employers that analysing or predicting performance at work is profiling. If AI is used to evaluate performance, Annex III of the EU AI Act classes it as high-risk from 2 December 2027, and Article 26.7 requires employers to inform workers' representatives and the people affected beforehand. Other jurisdictions have their own rules on workplace monitoring and consultation.
Which mistakes make 360-degree feedback useless?
The usual ones: long questionnaires full of generic competencies; scales without labels; teams so small that anonymity does not exist; cycles without calibration; results that reach the person by email with no conversation; and a review that is run once and never repeated, so nobody sees whether the actions worked.
There is a less visible one: asking about personality traits instead of behaviour. "She is open-minded" is an opinion about someone; "asks the team for input before deciding" is behaviour that can be observed, discussed and changed.
Sources
- Regulation (EU) 2016/679 (GDPR), Articles 5, 13, 15 and 22
- AEPD: list of processing types that require a data protection impact assessment (Art. 35.4, in Spanish)
- AEPD: data protection in employment relationships (guide updated in December 2025, in Spanish)
- Regulation (EU) 2024/1689 (AI Act), Article 26.7 and Annex III, point 4
- Regulation (EU) 2026/1744 (digital omnibus on AI), dates in Article 113
Frequently asked questions
- How many people should rate each person in 360-degree feedback?
- Enough for anonymity to hold in every relationship. If a relationship has very few responses, merge it with another or do not show it.
- Should 360-degree feedback decide pay?
- It can add evidence, but it should not be the only input. When people know their answer moves a colleague's salary, they rate differently and the 360 loses its value for development.
- Who chooses the peers who rate someone?
- The usual starting point is the teams in the organisation chart, with adjustments allowed before the cycle opens. What matters is that the list is closed before it starts and does not change halfway.
- How often should you run a 360?
- Once a year is usual, in line with the performance cycle. Repeating it before development actions have had time to show tires respondents and adds no new information.
- Can the person rated see who said what?
- Only for the named relationships, the self-assessment and the manager. Answers from peers and direct reports are shown combined and without authorship.