How to Choose a GDPR-Compliant Remote Proctoring Solution in the EU
Picture a German certification body that signs a proctoring contract in March. In September a candidate exercises her right of access and asks for every piece of personal data held about her exam session. The body discovers three things in the same week: the recordings sit with a US-hosted subprocessor nobody documented, retention was never configured so nothing has been deleted since launch, and no data protection impact assessment was ever completed. The supervisory authority is now involved, and the vendor's answer is that the customer is the controller.
The vendor is right. That is the part organisations keep learning the expensive way.
Choosing a GDPR-compliant proctoring solution in Europe is a controller obligation, and the vendor questionnaire is where you either discharge it or fail it. What follows is the sequence that actually works, in the order you should do it.
1. Fix your lawful basis before you shortlist anyone
You cannot evaluate a vendor until you know what you are lawfully permitted to do.
For universities, the usual candidates are performance of a task carried out in the public interest or legitimate interests. For private certification bodies and employers, legitimate interests or contract performance typically carry more weight. Consent is the weakest option in most exam contexts, because a candidate who must be proctored to receive a credential is not freely giving it.
Here is where organisations get this wrong: they pick consent because it feels safest, then build no alternative pathway, which makes the consent invalid and collapses the whole basis. If you rely on consent, a candidate must be able to refuse and still sit the exam some other way.
Write the basis down. Every downstream decision refers back to it.
2. Work out whether you are processing special category data
Facial matching that uniquely identifies a candidate is biometric processing under Article 9 of the General Data Protection Regulation, which prohibits processing of special categories of personal data unless a specific exception applies.
That is a higher bar than Article 6. Explicit consent is one route through it, and in an exam setting it carries the same freely-given problem described above.
Two practical consequences follow. Many organisations should skip biometric verification entirely for lower-stakes assessments and verify identity through document check and live proctor confirmation instead. And where you do use it, the Article 9 exception has to be identified in writing before procurement, not reverse-engineered afterwards.
3. Run the DPIA, and run it before you sign
According to the European Commission's guidance on when a DPIA is required, an assessment is required whenever processing is likely to result in a high risk to the rights and freedoms of individuals, and at least in three cases: a systematic and extensive evaluation of personal aspects of an individual including profiling; processing of sensitive data on a large scale; and systematic monitoring of public areas on a large scale.
The Commission also states that the DPIA should be conducted before the processing begins and treated as a living tool rather than a one-off exercise, and that where residual risks cannot be mitigated, the supervisory authority must be consulted before processing starts.
A national exam programme using automated behaviour flagging and biometric check-in sits inside the first two triggers. Assume you need one.
The DPIA is also your best procurement instrument. Drafting it forces vendors to answer specific questions about data flows, model behaviour and deletion, and those answers become evidence rather than sales claims. Do it in parallel with the shortlist.
4. Nail down residency and the transfer mechanism
"Where is the data hosted" is the question everyone asks. It is not quite the right one.
The right one is: which specific transfer mechanism covers each flow of personal data outside the EEA, and can you see the documentation?
For transfers to the United States, the European Commission adopted its adequacy decision on the EU-US Data Privacy Framework on 10 July 2023, introducing binding safeguards for personal data transferred from the EU to participating US organisations. If your vendor or one of its subprocessors relies on it, ask for their certification status. If they rely on standard contractual clauses instead, ask for the transfer impact assessment.
Also ask about support access. Recordings may sit on EU infrastructure while a support engineer in another region can open a session to troubleshoot. That is a transfer. It needs covering.
Some programmes need hosting segregation well beyond the default. Proctor360's GovCloud environment for regulated content, with a segregated storage account for each organisation and background-checked proctors, shows what that looks like in practice.
5. Set retention deliberately, then verify deletion happens
Article 5(1)(e) of the GDPR requires that personal data be kept in a form permitting identification for no longer than necessary for the purposes of processing. There is no fixed number. There is an obligation to justify yours.
For exam recordings, the defensible period is normally the appeal and academic-integrity window for that assessment, plus a short buffer. Set it per exam type. A recertification quiz does not need the retention period of a licensure exam.
Three checks catch most problems:
- ● Is retention configurable per exam, or only per account?
- ● Does deletion cover backups and derived artefacts such as flag logs and thumbnails, or only the primary video?
- ● Can the vendor produce a deletion confirmation you could hand to a supervisory authority?
If a vendor cannot answer the third question, treat retention as unmanaged.
6. Demand subprocessor transparency, in writing
Article 28 of the GDPR requires that a processor not engage another processor without prior authorisation from the controller, and that the same data protection obligations flow down the chain.
In practice you need a current, named list of subprocessors, not a category description. "Cloud hosting providers" is not a list. You also need notification of changes with a right to object, written into the contract.
This matters more than it used to. Proctoring stacks increasingly include third-party services for transcription, identity verification, model inference and storage, and each one is another organisation with access to a video of somebody's home.
Ask the awkward version of the question: is candidate video or audio ever used to train models, including a subprocessor's models? Get the answer as a contractual commitment.
7. Check the AI Act classification, not only the GDPR one
This is the step most 2026 procurement processes still miss.
Annex III of the EU Artificial Intelligence Act, published by the European Commission's AI Act Service Desk, classifies as high-risk "AI systems intended to be used for monitoring and detecting prohibited behaviour of students during tests in the context of or within educational and vocational training institutions at all levels." The same Annex classifies AI systems intended for biometric categorisation according to sensitive or protected attributes, and AI systems intended for emotion recognition, as high-risk.
Automated exam proctoring in an education or vocational training setting is therefore squarely inside a high-risk category, with obligations attaching to providers and deployers around risk management, data governance, technical documentation, record-keeping, transparency, human oversight and accuracy.
Two questions to put to any vendor:
- ● Does your system perform emotion recognition or infer candidate state, and can we switch it off?
- ● What documentation will you provide to support our obligations as a deployer?
A vendor that markets "stress detection" or "suspicion scoring" has just added a compliance category you probably did not want.
8. Test the human-review and contestation path
An automated flag should never be the final word on academic misconduct. Under a high-risk classification, meaningful human oversight is an expectation rather than a courtesy.
Ask to see the reviewer interface. Ask how a candidate is told a flag was raised, what evidence they receive, and how they contest it. Then ask how the system behaves for shared living spaces, assistive technology users, and candidates with atypical movement patterns. The quality of that answer tells you a great deal about the maturity of the product.
What a serious proctoring vendor should provide
Neutral requirements, then a straight answer on who meets them.
Security tiers matched to exam risk, so you are not applying licensure-grade monitoring to a formative quiz. Proctor360 offers five service tiers: AI Auto-Proctoring, AI Auto-Proctoring with Intervention, Single Webcam Live, Multi-Cam Live, which uses the candidate's phone as a second angle, and Institutional SaaS Remote Proctoring, remote proctoring software for organisations that want to proctor their own candidates. The 360° Total View™ headset covers the highest-stakes exams.
Documented compliance posture. Proctor360 holds SOC 2 Type I, GDPR and FERPA compliance, publishes a plain-language explanation of GDPR, keeps each organisation's data in a segregated storage account, background-checks staff, and conducts regular internal and external security penetration and load tests. Each camera in a multi-cam session is recorded as its own view, and default retention is six months.
Hardware-level monitoring where the stakes justify it. A patent-pending 360° Total View™ headset with camera, microphone and speaker captures the entire room rather than a webcam cone, and works for paper exams as well as online ones.
Human oversight designed in, with live proctors who can intervene mid-session, plus 11 named LMS and test-engine integrations so candidates never leave the environment they were trained on.
Independently visible service quality. Proctor360 is rated 4.9 out of 5 on G2 across 14 reviews and 5.0 out of 5 on Gartner Peer Insights across 3 ratings, ranked first for service and support among remote proctoring vendors.
Frequently Asked Questions
Is online proctoring GDPR compliant?
It can be, but compliance is a property of your deployment rather than of any product. You need a documented lawful basis, an Article 9 exception if you use biometric verification, a DPIA completed before processing begins, defined retention, and covered transfer mechanisms for any data leaving the EEA.
Do we need a DPIA for remote proctoring?
Almost certainly. The European Commission states a DPIA is required whenever processing is likely to result in high risk, and at least for systematic and extensive evaluation of personal aspects including profiling, and large-scale processing of sensitive data. Automated exam monitoring with biometric check-in generally meets those descriptions.
Is exam proctoring high-risk under the EU AI Act?
Annex III classifies AI systems intended for monitoring and detecting prohibited behaviour of students during tests within educational and vocational training institutions as high-risk. Emotion recognition systems and biometric categorisation systems are listed as high-risk as well, which is a reason to avoid vendors that infer candidate emotional state.
Does exam data have to stay in the EU?
Not necessarily. Data may leave the EEA where an appropriate transfer mechanism applies, such as the EU-US Data Privacy Framework adequacy decision adopted in July 2023 or standard contractual clauses with a transfer impact assessment. What you cannot do is transfer data without identifying and documenting the mechanism.
How long can we keep exam recordings under GDPR?
Only as long as necessary for the purpose. In practice that usually means the appeal and integrity window for that specific assessment, configured per exam type rather than as a single account-wide setting, with verifiable deletion afterwards.
What should we ask a vendor about subprocessors?
Ask for a current named list, contractual notification of changes with a right to object, confirmation of where each subprocessor processes data, and an explicit commitment that candidate video and audio are not used to train any model, including a subprocessor's.
Compliance is a procurement discipline
The organisations that get this right in Europe are not the ones with the strictest policies. They are the ones that asked the residency, retention, subprocessor and AI Act questions before signing, and got the answers in the contract rather than the pitch deck.
If you are running that evaluation now, schedule a demo and talk to the team about your lawful basis, your DPIA scope, and the security tier each of your exams genuinely needs.
Sources
- ● When is a Data Protection Impact Assessment (DPIA) required?, European Commission
- ● Regulation (EU) 2016/679 (General Data Protection Regulation), EUR-Lex, Publications Office of the European Union
- ● Annex III, EU Artificial Intelligence Act, AI Act Service Desk, European Commission
- ● Questions and Answers: EU-US Data Privacy Framework, European Commission
- ● Understanding GDPR, Proctor360
- ● GovCloud Remote Proctoring, Proctor360
- ● AI Auto-Proctoring, Proctor360
- ● Remote Proctoring Software, Proctor360
- ● 360° Total View™, Proctor360
- ● Book a Demo, Proctor360
Kranthi Bathula is the Co-Founder and CTO of Proctor360 and an online proctoring and assessment-security expert with extensive experience in EdTech, exam integrity, and AI-enabled test monitoring. He writes about remote proctoring, test security, AI in assessments, live and automated proctoring, and best practices for secure online testing. Through his engineering-driven insights, Kranthi helps educational institutions, certification bodies, and employers make informed decisions to protect the integrity of their exams.
