Online Exam Proctoring in the UK: Secure and GDPR-Compliant Solutions
A UK awarding organisation rolls out remote invigilation for a Level 3 qualification. Six weeks in, a candidate submits a subject access request asking for every piece of personal data held about her exam session, including the facial recognition template used at check-in. The operations lead forwards it to the data protection officer. The DPO asks a reasonable question: which lawful basis did we rely on, and where is the DPIA?
There isn't one. Procurement treated proctoring as a delivery tool rather than as processing of special category data, and now the awarding organisation has a compliance problem that predates the exam.
Online exam proctoring in the UK is not primarily a technology decision. It is a data protection decision that happens to involve technology, and the sequence in which you make those two decisions determines whether the deployment holds up.
The ICO has already told you what category this falls into
Start with definitions, because everything downstream depends on them.
The ICO's guidance on key data protection concepts for biometric recognition sets out that under Article 4(14) of the UK GDPR, personal information counts as biometric data only if it relates to physical, physiological or behavioural characteristics, has been processed using specific technologies, and can uniquely identify the person it relates to.
Then comes the part that catches exam teams out. Article 9 singles out biometric data as special category data when it is processed for the purpose of uniquely identifying someone. Your purpose determines the classification. A facial image sitting in a candidate record is personal data. That same image run through matching software to confirm the person at the keyboard is the registered candidate is special category biometric data, with the additional conditions for processing that entails.
The ICO is explicit on one more point that vendors sometimes gloss over. Processing includes transient processing. If a system creates a biometric template, compares it, and discards it in a fraction of a second, data protection requirements still apply.
You almost certainly need a DPIA
Remote proctoring combines several of the factors the ICO treats as high risk: special category data, ongoing monitoring of candidates, and often large-scale processing. The ICO's guidance on when a DPIA is required covers systematic and extensive profiling, large-scale processing of special category data, and other processing the ICO lists as likely high risk, such as biometric data.
Do it early, while you can still change the design. A DPIA written after go-live is a compliance artefact. A DPIA written during vendor selection is a design tool, and it will usually push you toward less intrusive configurations that you would not have considered otherwise.
The ICO's guidance also flags the consequence of skipping the analysis: where a DPIA identifies a high residual risk that you cannot mitigate, you must consult the ICO before proceeding.
Consent is harder than it looks
The instinct is to rely on explicit consent, since that is often the only available condition for processing special category biometric data. Reasonable instinct, awkward execution.
Consent has to be freely given. A candidate who cannot sit the exam without agreeing to biometric verification is not in a strong position to refuse, and the ICO has been consistent about power imbalance undermining consent in employment contexts. The same logic applies to a learner whose qualification depends on the session going ahead.
There are two practical responses, and serious awarding organisations use both.
Offer a genuine alternative route. A test centre slot, a manually verified check-in, or a different identity verification method gives the candidate a real choice, which is what makes the consent meaningful.
Separate the layers of the consent. Identity verification, session recording, room monitoring and retention are distinct processing operations with distinct risks. Bundling them into one checkbox that says "I agree to be proctored" is exactly the pattern the ICO criticises.
Data residency and international transfers
Where do the recordings go?
This is the question UK buyers should ask first and usually ask fourth. Session video, audio, screen capture and identity documents are among the most sensitive records your organisation will ever hold about a learner. If the platform routes that data outside the UK, you need a lawful transfer mechanism and you need to document it.
The practical requirements to nail down in the contract:
- ● Storage region and processing region, stated separately
- ● Sub-processor list, with notification obligations when it changes
- ● Retention period per data type, since identity documents and session recordings should not carry the same clock
- ● Deletion evidence, meaning what you actually receive when you ask for confirmation
- ● Whether any recording is used for model training, and an explicit prohibition if not
Vendors that answer these quickly and in writing have been asked before. Vendors that promise to come back to you have not.
Ofqual's position on remote invigilation
Regulated qualifications add a second layer on top of data protection.
Ofqual published a detailed account of remote assessment and invigilation in vocational and technical qualifications, noting that awarding organisations introduced more remote assessment and remote invigilation than any other form of adaptation during the pandemic. The regulator was clear that such arrangements should not undermine the value of the qualifications, and equally clear that it expected them to persist.
One observation in that piece is worth pulling out. Ofqual noted examples where adding a second camera recording the assessment from a different angle enhanced an awarding organisation's ability to identify and investigate malpractice. That is the regulator, not a vendor, noting the value of a second angle.
Ofqual also flagged the operational details that trip people up, including how to handle supervised comfort breaks during a three-hour remotely invigilated assessment. Small problems like that determine whether a rollout works.
What a serious proctoring vendor should provide
Set the requirements without reference to any particular supplier.
The vendor should be able to state its data residency and transfer position precisely, in writing, before contract. It should support DPIA work by supplying processing details rather than leaving you to reverse-engineer them from a privacy notice. It should offer multiple monitoring tiers so you can apply the least intrusive option that meets the risk, which is a data minimisation requirement as much as a budget one. It should hold recognised compliance attestations covering GDPR alongside SOC 2. It should support monitoring beyond the single webcam frame, given what Ofqual itself observed about second camera angles. And it should keep organisational accounts separated, run regular internal and external penetration testing, and screen its proctoring staff.
Here is how Proctor360 maps to that specification. It operates in the UK through an international partner, alongside partners in Brazil, Singapore, India and Spain. The platform holds SOC 2 Type I, GDPR and FERPA compliance, keeps each organization's data in a segregated storage account, performs background checks on staff, and runs regular internal and external security penetration and load tests. The company publishes plain-language explanations of its data handling, including a privacy explainer and a dedicated page on GDPR.
On the monitoring question, five service tiers let you match intrusiveness to risk rather than applying one setting to everything: AI Auto-Proctoring, AI Auto-Proctoring with Intervention, Single Webcam Live, Multi-Cam Live, and Institutional SaaS Remote Proctoring. AI auto-proctoring handles automated check-in, automated ID verification, and incident flagging for lower-risk assessments. Single-webcam live adds a human who can intervene during the session. Multi-cam live uses the candidate's own phone as a second camera, which applies the same principle Ofqual described, that a second angle improves the ability to investigate malpractice. Each camera is recorded as its own view that a reviewer can play back individually, and default retention is six months. For the highest-stakes assessments, 360° Total View™, a patent-pending headset with a 360-degree camera, microphone and speaker, captures the full room and works for paper exams as well as online ones.
Frequently Asked Questions
Is online exam proctoring legal in the UK?
Yes, provided you comply with the UK GDPR. Because most proctoring involves biometric identity verification and systematic monitoring, you will normally be processing special category data, which requires an Article 9 condition in addition to an Article 6 lawful basis. Complete a data protection impact assessment before deployment rather than after.
Do we need a DPIA for remote proctoring?
In almost all cases, yes. The ICO requires a DPIA for large-scale processing of special category data and for other processing it lists as likely high risk, such as biometric data, and typical proctoring deployments involve both. If the DPIA identifies a high residual risk you cannot mitigate, you must consult the ICO before you proceed.
Is facial recognition in proctoring classed as special category data?
It is, when the purpose is to uniquely identify the candidate. The ICO's biometric guidance is explicit that biometric data becomes special category biometric data when used for unique identification, and that the requirement applies even where the biometric template exists only transiently before being discarded.
Can we rely on candidate consent for proctoring?
You can, but consent must be freely given, which is difficult when the alternative is not sitting the exam. Offer a genuine alternative route such as a test centre or manual identity check, and separate consent for distinct processing operations rather than bundling identity verification, recording and retention into a single checkbox.
Where is UK candidate exam data stored?
That depends on the vendor and sometimes on the service tier, so ask for storage region, processing region and backup region separately and get the answer in the contract. Also request the sub-processor list and the notification terms for changes to it. If data leaves the UK, document your transfer mechanism.
How long should we keep proctoring recordings?
Only as long as you need them for your stated purpose, typically the appeals and malpractice investigation window for that qualification. Apply different retention clocks to different data types, since an identity document does not need to be held as long as a session recording. Write the periods into the contract and ask what deletion confirmation you receive.
Get the data protection work done before the procurement
The UK deployments that go badly are almost never the ones where the software failed. They are the ones where the DPIA came last, consent was a single checkbox, and nobody could say where the recordings were stored when a candidate asked.
Do the DPIA first. Let it shape which monitoring tier you actually need, then buy against that.
If you want to work through the data protection questions alongside a delivery plan, schedule a demo and talk to the team about your exam program.
Sources
- ● Biometric data guidance: key data protection concepts, Information Commissioner's Office
- ● When do we need to do a DPIA?, Information Commissioner's Office
- ● Remote assessment and invigilation in vocational and technical qualifications, Ofqual, GOV.UK
- ● Privacy Explained, Proctor360
- ● Understanding GDPR, Proctor360
- ● AI Auto-Proctoring, Proctor360
- ● Multi-cam Live Proctoring, Proctor360
- ● 360° Total View™, Proctor360
- ● Book a Demo, Proctor360
Kranthi Bathula is the Co-Founder and CTO of Proctor360 and an online proctoring and assessment-security expert with extensive experience in EdTech, exam integrity, and AI-enabled test monitoring. He writes about remote proctoring, test security, AI in assessments, live and automated proctoring, and best practices for secure online testing. Through his engineering-driven insights, Kranthi helps educational institutions, certification bodies, and employers make informed decisions to protect the integrity of their exams.
