What the DPDP Act is
The DPDP Act 2023 is India’s law governing the processing of digital personal data. Parliament passed it in August 2023, and it applies to:
- Personal data processed in India that was collected digitally, or collected offline and digitized later.
- Personal data processed outside India when the processing is connected with offering goods or services to people in India.
For a university, that takes in nearly everything an exam cycle touches, from online registration and digitized application forms to scanned answer scripts, result databases and proctoring recordings.
The Act gives organizations duties and individuals rights. It also creates a regulator, the Data Protection Board of India, which can investigate breaches of the Act and impose penalties.
Who is who: the roles under the Act
- Data Principal. The person the data is about, which in an exam means the student or candidate. When that person is a child, the parent or lawful guardian acts for them.
- Data Fiduciary. The organization that decides why and how personal data is processed. In a university exam, that’s usually the university or college.
- Data Processor. An organization processing data on a Data Fiduciary’s behalf. Proctoring providers, on-screen marking vendors and cloud hosts are usually Data Processors.
- Consent Manager. A registered entity that lets a Data Principal give, manage and withdraw consent.
- Data Protection Board of India. The body that deals with complaints and breaches and imposes penalties.
What universities most need to know is that the Data Fiduciary remains responsible for compliance, and that includes processing carried out by its Data Processors. The Act only allows a Data Fiduciary to engage a Data Processor under a valid contract, so your vendor contracts matter.
Where exam data fits
In a typical exam cycle, every step creates personal data:
| Stage | Examples of personal data |
|---|---|
| Registration and fees | Name, contact details, date of birth, program, payment records |
| Eligibility and hall tickets | Attendance, prior results, photograph |
| Identity checks | ID document image and, in online exams, face checks |
| The exam itself | Answers, answer scripts, timestamps, event logs |
| Proctoring | Video, audio, screen recordings, flags, reviewer decisions |
| Malpractice | Case records, committee decisions, evidence |
| Marking and results | Marks, grades, SGPA and CGPA, revaluation requests |
| Credentials | Transcripts and degrees |
The Act treats every one of these as personal data. Unlike some earlier drafts, it doesn’t set up a separate, stricter category of “sensitive” personal data such as biometrics. Face checks and recordings are still high risk, though, and other laws or contracts may handle them more strictly.
The duties that matter most for exam offices
Notice and consent
When consent is your ground for processing, the Act requires a notice before or at the moment you ask for consent. It should describe the personal data and the purpose, explain how the Data Principal can exercise their rights and withdraw consent, and say how to complain to the Board. The consent itself has to be free, specific, informed, unconditional and unambiguous. It must be given through a clear affirmative action and cover only the data needed for the stated purpose.
The Data Principal can choose to receive the notice in English or in any language listed in the Eighth Schedule to the Constitution.
It has to be as easy to withdraw consent as it was to give it. Decide what happens to a candidate’s exam if they withdraw consent to proctoring, and put that in your policy.
Legitimate uses
The Act also lists certain “legitimate uses” for which a Data Fiduciary can process personal data without consent. Examples include a person voluntarily providing data for a specified purpose without objecting, and functions of the State under law. Ask your legal counsel whether a given exam activity counts as a legitimate use, and whether public and private institutions are treated differently.
Security safeguards and breach reporting
A Data Fiduciary has to protect personal data, including data its Data Processors hold, with reasonable security safeguards to prevent a breach. When a personal data breach happens, it must tell the Data Protection Board and every affected Data Principal. The Rules set the form and timing of these reports, and one reported requirement is a detailed report to the Board within 72 hours of becoming aware of the breach.
Retention and erasure
Once the Data Principal withdraws consent, or once it’s reasonable to assume the specified purpose is no longer being served, a Data Fiduciary must erase the personal data (unless the law requires it to be kept) and have its Data Processors erase it as well. The Rules also set minimum periods for keeping certain logs.
In practice, you’ll need a retention period for each type of exam data. Your regulator’s rules may require results and transcripts to be kept for a long time, whereas a proctoring recording from a quiz probably doesn’t need to be.
Where data is used to make a decision affecting the Data Principal, the Act also requires the Data Fiduciary to make sure it is complete, accurate and consistent. That bears directly on marks, malpractice findings and results.
Students under 18
Entrance and admissions exams are where this part of the DPDP Act is most likely to bite, since many candidates are still under 18. The Act defines a “child” as anyone under 18.
A Data Fiduciary needs verifiable consent from the parent or lawful guardian before it processes a child’s personal data. The Act also prohibits processing likely to harm a child’s well-being, as well as tracking or behavioral monitoring of children and advertising targeted at them.
The Government can exempt certain classes of Data Fiduciaries, or certain purposes, from some of these rules. The DPDP Rules reportedly include exemptions for educational institutions for specific purposes such as educational activities and children’s safety. Before you proctor entrance exams for candidates under 18, check with your counsel whether an exemption covers online proctoring of minors, and how.
Rights of students and candidates
The Act gives a Data Principal the right to:
- Receive a summary of the personal data being processed and of the processing activities.
- Correct, complete, update and erase their personal data.
- Use a readily available grievance redressal route with the Data Fiduciary before approaching the Board.
- Nominate someone else to exercise their rights if they die or become incapacitated.
For an exam office, the practical test is whether you can find, export and, where appropriate, correct or erase everything you hold on one candidate, including what your vendors hold. Having one case record per candidate makes that far easier.
Significant Data Fiduciaries
The Government can notify certain Data Fiduciaries as “Significant Data Fiduciaries”, taking into account factors like the volume and sensitivity of data and the risk to Data Principals. These organizations carry extra duties. They must appoint a Data Protection Officer based in India and an independent data auditor, and they must run periodic data protection impact assessments and audits. Large universities and national exam bodies should check whether they could be notified.
Data outside India
On cross-border transfers, the DPDP Act is permissive. Personal data can go outside India except to countries the Government restricts by notification, although sector rules or other laws requiring stricter localization still apply.
Plenty of universities still choose to keep exam data in India, for simplicity and because of their own policies. Ask each vendor where your data is stored and whether you get to choose.
Penalties and the Data Protection Board
The Data Protection Board of India can look into breaches of the Act and impose monetary penalties. Maximum penalties differ by type of breach. The highest, for failing to take reasonable security safeguards, is reported at up to INR 250 crore, and failing to report a breach or breaking the rules on children’s data each carry their own maximum.
The DPDP Rules and timelines
The Act is coming into force in phases. The Digital Personal Data Protection Rules were notified in November 2025. Some provisions took effect immediately, while most Data Fiduciary duties begin after a transition period that has been reported as 18 months. The Ministry of Electronics and Information Technology (MeitY) publishes the notifications that set exact dates, so check the current ones to see when each duty applies to you.
Exam cycles are planned a year or more in advance, whatever the exact date turns out to be. The contracts, notices and retention policies you agree now will still be in force once the duties apply.
A DPDP checklist for exam offices
- Map your exam data. List each type of personal data in your exam cycle, where it’s stored and who holds it.
- Name the roles. Confirm in writing that your institution is the Data Fiduciary and each vendor is a Data Processor.
- Review vendor contracts. Make sure they cover purpose limits, security, breach reporting, deletion, subprocessors and data location.
- Decide your ground for processing for each activity (consent or a legitimate use) together with your counsel.
- Rewrite your exam notices in plain language and in the languages your candidates need.
- Plan for withdrawal. Set out what happens when a candidate withdraws consent to proctoring.
- Identify candidates under 18 and put verifiable parental consent in place, or confirm that an exemption applies.
- Set retention periods for each type of data, and check that deletion reaches vendors and backups.
- Set up a rights process so you can answer access, correction and erasure requests within your policy timelines.
- Set up a grievance channel and make it public.
- Prepare a breach plan that names the people involved and covers the Board report and candidate notices.
- Train your exam team, invigilators, reviewers and malpractice committee members included.
How Proctorly supports DPDP work
Proctorly can’t make your institution compliant. Only your institution’s policies and decisions can. We can, however, make the exam side easier to run and easier to explain.
- Data hosted in the client’s geographic location by default. Institutions can also keep data in their own S3 bucket.
- Retention set by your institution, following each exam’s policy, with deletion across live storage and backups. A documented deletion process is planned.
- Collect what the level needs. You pick an assurance level for each exam, so a quiz doesn’t collect what a licensing exam does.
- Candidates are told what is captured before the exam begins, and nothing is monitored in secret.
- Face checks are kept only as hashed, unchangeable signatures, and only when an institution runs repeat exams for the same students. They are deleted on request when the contract ends.
- Each institution’s data is kept separate, staff have least-privilege access and every access is logged, our reviewers’ included.
- A tamper-evident audit trail and one case record per candidate, plus an evidence pack you can export for an appeal, an audit or a candidate’s access request.
- People decide. An automated flag never fails a candidate. A reviewer records a decision with a reason, and your institution makes the call.
- No AI training on candidate data unless your institution opts in.
- Our main subprocessor appears on our subprocessors page, and the full, current list comes with the data processing agreement or on request.
We design Proctorly to support institutions’ obligations under India’s DPDP Act, GDPR, FERPA and biometric privacy laws such as Illinois BIPA. You’ll find full details on our proctoring privacy page.
Frequently asked questions
Does the DPDP Act apply to universities?
Generally, yes. The DPDP Act covers any organization processing digital personal data in India, and universities and colleges aren’t excluded as a class. A university running registration, exams and results digitally is usually the Data Fiduciary for that data. Some purposes may qualify for specific exemptions, so check the details with your legal counsel.
Is online proctoring allowed under the DPDP Act?
The Act doesn’t ban proctoring. What it does is attach conditions to processing personal data: a lawful ground, a clear notice, purpose limits, security, breach reporting and erasure once the purpose is served. Proctoring candidates under 18 brings extra questions about parental consent and limits on monitoring children, which you should work through with your counsel before exam season.
What is the DPDP Act 2023 in simple terms?
It’s India’s law on digital personal data. Organizations have to tell people what data they collect and why, rely on consent or another permitted ground, use the data only for that purpose, keep it secure, report breaches and delete it when it’s no longer needed. People gain rights to access, correct and erase their data, and a regulator enforces the law.
Who is responsible if a proctoring vendor has a data breach?
Under the Act, the university, as Data Fiduciary, remains responsible for personal data processed on its behalf, including by its Data Processors. It needs reasonable safeguards in place and must report breaches to the Data Protection Board and to affected candidates. For that reason, your contract with any exam or proctoring vendor should cover security and breach reporting.
When do universities need to comply with the DPDP Act?
The Act applies in phases. The DPDP Rules were notified in November 2025, and most Data Fiduciary duties are reported to start after an 18-month transition, so check MeitY’s current notifications for exact dates. Exam contracts and notices you sign today will probably still be running when the duties apply, which is why it pays to plan early.