Is proctoring legal? What the law expects, and how Proctorly is built to meet it

The short answer

Online proctoring is generally permissible in many jurisdictions, but its legality depends on the institution, the examination context, the monitoring technologies used, and the laws applicable to candidates and their personal data.

Institutions may need to establish a lawful basis for processing, provide appropriate privacy notices, minimize unnecessary monitoring, implement security controls, provide reasonable accommodations, and establish procedures for reviewing disputed examination outcomes.

Where biometric identification or AI-assisted monitoring is used, additional requirements may apply. These include restrictions under the EU GDPR and AI Act, US state biometric privacy legislation, and India’s Digital Personal Data Protection framework.

Proctorly is designed to support institutions in implementing appropriate safeguards, including human oversight, configurable examination monitoring, and institution-controlled data-handling arrangements.

However, using a proctoring platform does not automatically establish legal compliance. Each institution remains responsible for assessing its applicable obligations, configuring the examination appropriately, and implementing the required legal and operational safeguards.

Across very different legal systems, the same tests keep appearing:

• Is it necessary? The level of monitoring should match the stakes of the exam. A weekly quiz and a licensing exam do not need the same watching.
• Is it disclosed? Before the exam starts, candidates should know what is captured, why, who sees it and for how long.
• Is there a lawful basis? Depending on the jurisdiction, that could be consent, a legal duty, a contract or another basis the law recognizes.
• Is it limited? Collect what the chosen level needs, use it only for the exam, and delete it on schedule.
• Is it secure? Recordings and biometric data need strong protection and logged access.
• Do people decide? An algorithm can raise questions about a candidate. It should never reach the conclusions.

Careless proctoring can break the law in places where well-run proctoring is perfectly fine. The rest of this page works through those tests, one law at a time.

Six questions every privacy law asks about proctoring

Before getting into individual laws, it helps to see what they have in common. If your institution can answer these six questions in writing, you are most of the way to a defensible setup in any jurisdiction.

1. What do we tell candidates, and when? A clear notice before the exam, in plain language, listing what is captured: ID image, face checks, audio, video, screen and event logs.
2. On what basis do we process it? Your legal team decides this for your jurisdiction and type of institution. The answer shapes how you word the notice and whether you need consent.
3. Do we collect only what this exam needs? Pick the assurance level for each exam. Putting live proctors on a low-stakes quiz is hard to justify.
4. How long do we keep it? Set a retention period for each exam policy and make sure deletion actually happens, backups included.
5. Who can see it, and is that logged? Reviewers, faculty, committees and the vendor’s own staff should each see only what their role needs.
6. Who makes the decision about a candidate? A named person or committee at your institution, with a way for the candidate to appeal.

Our proctoring privacy page shows how Proctorly answers questions 1, 3, 4 and 5 at each assurance level. Question 6 is covered on our human review proctoring page.

Proctoring and GDPR

The EU General Data Protection Regulation (GDPR) applies to institutions in the European Economic Area, and it can also apply to institutions elsewhere that offer exams to people in the EEA. The UK has its own version, the UK GDPR, with very similar rules. GDPR questions about proctoring usually come down to three points.

Face checks and special category data

Under the GDPR, biometric data processed to uniquely identify a person is “special category” data (Article 9). Processing it is prohibited unless one of the listed conditions applies, such as explicit consent or a substantial public interest set out in law. Regulators have questioned whether consent can be “freely given” when a student needs to pass the exam, so many institutions think carefully about offering an alternative.

In practice, that means deciding whether face matching is necessary for each exam, telling candidates exactly how it works, and planning for candidates who should not or cannot use it. In Proctorly, a failed face check goes to a person and never to an automatic fail. If some of your candidates cannot use face verification, talk to us and we will plan the exam with you.

Automated decisions

Article 22 of the GDPR gives people the right not to be subject to a decision based solely on automated processing that significantly affects them, with limited exceptions and safeguards. A failed exam or a misconduct finding would very likely count as significant.

So the design matters. In Proctorly, no automated flag fails a candidate or imposes a sanction. A trained reviewer looks at each flag and records a decision with a reason, and your institution makes the finding. This is built into the product and can’t be switched off.

Data protection impact assessments

The GDPR requires a data protection impact assessment (DPIA) where processing is likely to result in a high risk to people, and it names systematic monitoring and large-scale processing of special category data as examples (Article 35). Most remote proctoring programs will need one. Your DPIA will ask you to describe the processing, its necessity and proportionality, the risks and the safeguards. We wrote the information on our proctoring privacy page and in the security and integration pack to help you fill it in.

Institutions in the EEA usually act as the “controller” and the proctoring vendor as the “processor”, which calls for a written data processing agreement under Article 28. Proctorly data is hosted in the client’s geographic location by default, and institutions can keep data in their own S3 bucket, which helps when your DPIA sets a location requirement.

FERPA and proctoring in the United States

The Family Educational Rights and Privacy Act (FERPA) is a US federal law that protects the privacy of student education records at schools and institutions that receive funding from the US Department of Education. Questions about FERPA and proctoring usually come from registrars and general counsel.

When a proctoring vendor acts for the institution

FERPA generally limits disclosure of personally identifiable information from education records without the student’s consent. One common exception lets an institution share records with “school officials” who have a legitimate educational interest. Outside contractors can fall within that exception when they perform a service the institution would otherwise do itself, are under the institution’s direct control for the use of the records, and do not re-use the data for other purposes.

That last condition is one reason our commitment matters. We do not use candidate recordings and data to train our AI models unless your institution opts in.

Recordings as education records

A proctoring recording, a flag and a reviewer’s decision that are directly related to a student and kept by or for the institution may be education records under FERPA. If they are, students generally have a right to inspect them, and the institution must control who else sees them.

Proctorly keeps each case as one record, with the clips, the timeline, the reviewer’s reasoning and a tamper-evident audit trail of every view, decision and change. The evidence pack exports that record in one step, which helps when a student asks to see what was recorded about them.

FERPA is not the only US law in play. State student privacy laws and, for some institutions, state public records laws can add duties, so ask your counsel which ones apply to you.

Biometric privacy laws: Illinois BIPA and others

The Illinois Biometric Information Privacy Act (BIPA) regulates biometric identifiers such as face geometry. Broadly, before a private entity collects biometric data from someone in Illinois, it must give written notice of the purpose and duration, obtain a written release, and publish a retention schedule with destruction guidelines. BIPA also lets individuals sue, which has made it the basis of many lawsuits in education technology. Some public institutions may be treated differently under the Act.

Other US states, including Texas and Washington, have their own biometric laws, and more states have added biometric rules to broader privacy laws.

Here is how Proctorly handles face data. We tell candidates what is captured, why, and when it will be deleted. Face checks are kept only as hashed, unchangeable signatures, and only when an institution runs repeat exams for the same students. When the contract ends, they are deleted on request. We design Proctorly to support institutions’ obligations under India’s DPDP Act, GDPR, FERPA and biometric privacy laws such as Illinois BIPA. Our proctoring privacy page has more detail.

India's DPDP Act

India’s Digital Personal Data Protection Act, 2023 sets rules for processing digital personal data in India, and for processing outside India that is connected with offering goods or services to people in India. A university running a proctored exam is usually the “Data Fiduciary”, and the proctoring provider is a “Data Processor” acting on its behalf.

For exams, the parts that matter most are notice, consent or another lawful ground, purpose limitation, security safeguards, breach reporting, erasure once the purpose is served, and stricter rules for children’s personal data, which covers any candidate under 18. That last point matters for entrance and admissions exams, where many candidates are still minors.

Our guide to the dpdp act for universities covers this in detail, with a checklist for exam offices.

Beyond privacy law: searches, disability and fairness

Proctoring raises legal questions that go beyond privacy statutes.

Searches of a candidate’s room. In 2022, a US federal district court in Ohio held that a public university’s required room scan before a remote exam was an unreasonable search under the Fourth Amendment. The ruling applies to public institutions in specific circumstances and is not binding everywhere, but it shows that courts look at how intrusive each step is. With Proctorly’s assurance levels, you can match the watching to the stakes.

Disability and accommodations. Disability laws such as the Americans with Disabilities Act and Section 504 in the US, and the Rights of Persons with Disabilities Act, 2016 in India, generally require institutions to provide reasonable accommodations in assessments. Proctoring must not penalize a candidate for needing one. In Proctorly, reading aloud, assistive tools and disability-related movement are not misconduct, and unusual audio and movement are raised only as signals for a person to review in context. Accommodations that travel with the candidate and stop the flags they would otherwise cause are planned. See proctoring accommodations.

Bias and fairness. Face technology doesn’t work equally well for everyone in every condition, and anti-discrimination law can apply when a system disadvantages a protected group. Our proctoring bias page explains how we test for fairness across devices, networks, lighting and accommodations, and why a score is only ever a review priority.

Our commitments

These are product principles, and we are publishing them now.

1. An AI flag is never a finding. People review, and your institution decides.
2. We do not infer emotion, personality or intent from a candidate’s face or voice.
3. No hidden monitoring. Candidates are told what is captured before the exam starts.
4. We never claim to catch all cheating. Our coverage summary sets out what each setup can and cannot observe.
5. A technical failure is never treated as misconduct. We plan to keep it as its own category in every report, outside the integrity score.
6. We keep data only as long as your policy says, then delete it. We never use candidate data to train our AI models unless your institution opts in.

Our main subprocessor is listed on our subprocessors page. The full, current list is in the data processing agreement, and we can send it on request. Proctorly follows our Privacy Policy.

Explore the Trust Center

• Proctoring privacy. What we capture at each assurance level and why, where data is stored, who can see it, and how retention and deletion work.
• Proctoring bias. How we test our detection and monitor fairness, and why no score is a verdict.
• Proctoring accommodations. Extra time, breaks, assistive software and identity options for candidates who need them, with what works today and what is planned.
• DPDP Act guide for universities. India’s data protection law applied to exam data, with a checklist.
• Security at Proctorly. Hosting, data separation, logged access, and vulnerability assessment and penetration testing.
• What proctoring can and cannot see. A straight account of what each setup observes, blocks and cannot see.

A checklist for exam offices before the next sitting

Work through this list with your legal, IT and academic teams. Treat it as a starting point. It is not a legal opinion.

1. Name the person or committee who decides misconduct cases, and write down the appeal route.
2. Choose an assurance level for each exam and record why that level fits the stakes.
3. Confirm your lawful basis for each jurisdiction your candidates sit in.
4. Publish a candidate notice that lists what is captured, why, who sees it and for how long.
5. Decide how you will verify candidates who cannot or should not use face matching.
6. Set retention periods for each exam and confirm that deletion covers backups.
7. Agree a data processing agreement with your provider that covers data location and subprocessors.
8. Complete or update your impact assessment where your law requires one.
9. Set up an accommodations process before registration closes, well ahead of exam day.
10. Brief faculty and reviewers that a flag raises a question and does not answer it.

Frequently asked questions