This is not legal advice. This checklist explains common readiness steps in general terms for education teams. The DPDP Act’s Rules, timelines and official guidance can change, and how they apply depends on your institution. Please confirm your obligations with your legal counsel.
Exams are one of the heaviest uses of student data an institution has: registration forms, hall tickets, ID images, answer scripts, marks and, for online exams, video, audio, screen recordings and face checks. This checklist turns the Act’s main duties into tasks an exam office can assign, track and close with its legal and IT teams.
What you’ll learn
- How to map every type of personal data in an exam cycle, and where it is held
- How to set out the Data Fiduciary and Data Processor roles with your vendors in writing
- What to cover in plain-language exam notices, and how to plan for withdrawal of consent
- Points to raise with counsel before proctoring candidates under 18
- How to set retention per data type and confirm that deletion reaches vendors and backups
- How to prepare a rights process, a grievance channel and a breach plan
Who it’s for
Registrars, Controllers of Examinations, data protection leads, IT heads and the legal teams who advise them at Indian universities, colleges and entrance exam cells. For the background on the Act itself, start with our DPDP Act guide for universities.
Inside the whitepaper
How to use this checklist
Who should own each section, and how to record status and evidence as you go.
Map the personal data in your exam cycle
A table of exam stages and the personal data each creates, from registration to credentials.
Roles, contracts and processors
What to put in vendor contracts: purpose limits, security, breach reporting, deletion, subprocessors and data location.
Notice, consent and legitimate uses
Deciding the ground for each activity with counsel, and writing notices candidates can read in their language.
Candidates under 18
Verifiable parental consent, possible exemptions for educational institutions, and the questions to settle before an entrance exam season.
Retention, erasure and backups
Setting retention per exam type around appeal windows and regulator rules, and confirming deletion across live storage and backups.
Rights requests and grievances
Answering access, correction and erasure requests, and publishing a grievance channel.
Security safeguards and breach readiness
Reasonable safeguards, named breach roles, and the reports the Rules require.
Questions to ask your exam vendors
Where data is stored, who can see it, whether candidate data trains AI models, and how the vendor supports access requests.
The download includes the full checklist as a printable and editable document, with owner and status columns. For how Proctorly handles candidate data, including hosting in the client’s geographic location by default, see proctoring privacy.