Not legal advice. This post describes questions institutions commonly work through and how Proctorly handles data. How the law applies depends on your institution, and the Rules and official guidance can change. Please confirm your position with your legal counsel.
India’s Digital Personal Data Protection Act, 2023 applies to the personal data an exam cycle creates, and online proctoring adds video, audio, screen recordings and face checks to that list. Our full explainer on the DPDP Act for universities covers roles, duties and timelines. This post looks only at recordings, and at the five questions exam offices ask us most.
1. What must candidates be told before the exam?
Under the Act, the university is usually the Data Fiduciary and decides why and how data is processed. Whatever lawful ground your counsel settles on, candidates should know what is captured before the exam starts. A good exam notice covers what is recorded at the chosen assurance level, why it is needed, who will see it, how long it is kept, how to ask questions and how to appeal a decision.
On Proctorly, candidates are told what is captured before the exam starts, and there is no hidden monitoring.
2. How long should we keep recordings?
This is your decision, not your vendor’s. On Proctorly, your institution sets retention per exam policy. One practical way to set it:
- Start from the length of your appeal and reconsideration windows.
- Add any record-keeping duty your regulator or accreditor sets.
- Hold recordings for open cases until the case closes.
- Keep nothing longer than the purpose needs.
A weekly quiz recording might be kept for a few weeks. A paper likely to face appeals may need longer. When the period ends, data is deleted across live storage and backups. A documented deletion process is planned.
3. Where is the data stored?
The Act takes a broadly permissive approach to transfers outside India, subject to Government restrictions, but many universities prefer to keep exam data in India for their own policies. On Proctorly, data is hosted in the client’s geographic location by default. Institutions can also choose another AWS region or keep data in their own S3 bucket, which helps when a contract or internal policy sets a location.
4. What should our vendor contract cover?
A proctoring provider usually acts as a Data Processor, and the Data Fiduciary stays responsible for processing done on its behalf. Ask every vendor, including us, to cover in writing:
- Purpose limits, including whether candidate data trains AI models. On Proctorly it does not, unless your institution opts in.
- Security safeguards and breach notification.
- Retention and deletion, including backups.
- Subprocessors. Our main subprocessor is listed on our subprocessors page, and the full, current list is in the data processing agreement and available on request.
- Data location and access controls. On Proctorly, each institution’s data is kept separate and all staff access is logged, including our reviewers’.
5. How do we answer a candidate’s request about their data?
Data Principals have rights to a summary of their data, correction and erasure, and grievance redressal. In practice, the test is whether you can find everything you hold about one candidate. On Proctorly, each candidate has one case record, and the evidence pack can be exported for an appeal, an audit or an access request. Requests for erasure need to be weighed against any open case or legal retention duty, which is a question for your counsel.
A note on face checks and minors
Face checks deserve extra care even where the law does not single them out. On Proctorly, face checks are kept only as hashed signatures, only when an institution runs repeat exams for the same students, and are deleted on request when the contract ends. If you proctor entrance exams where candidates may be under 18, the Act’s rules on children’s data need a specific conversation with your counsel before the cycle opens.
For what Proctorly captures at each level, see proctoring privacy. For the wider legal picture across GDPR, FERPA and biometric laws, see our Trust Center page on whether proctoring is legal.
Frequently asked questions
Does Proctorly make our institution DPDP compliant?
No vendor can. Compliance depends on your institution’s notices, policies and decisions, though we can make the exam part easier to run and explain.
Is candidate video used to train Proctorly’s AI?
Not unless your institution opts in. Without an opt-in, data is used to run the exam, review flags and give your institution its case record.
If your legal or IT team is reviewing vendors, request the security and integration pack when you book a demo.