Proctoring Software in Australia: Secure Online Exam Monitoring for Universities
Picture an academic integrity officer at a Group of Eight university who opens a Monday morning queue of 340 flagged exam sessions. Roughly a third are students in share houses where a flatmate walked past the door. Another chunk are candidates in Perth whose sessions started at 6 am local time because the exam window was set in Sydney. A handful are genuine. Working out which is which takes eleven days, and by then two students have lodged formal complaints about being recorded in their bedrooms.
The technology worked exactly as sold. The programme still failed.
Choosing proctoring software in Australia is less about detection accuracy than about three things that determine whether the system survives contact with real students: what the Privacy Act permits you to collect, where the data sits, and whether the operational design accounts for a continent that spans multiple time zones and a student body scattered well beyond it.
Biometric data is sensitive information, and that changes the rules
Start with the classification, because everything else follows from it.
The Office of the Australian Information Commissioner's Australian Privacy Principles guidelines on key concepts treat biometric information used for automated biometric verification or identification, and biometric templates, as sensitive information under the Privacy Act 1988.
Now apply the collection rule. Under Australian Privacy Principle 3, an APP entity must not collect personal information other than sensitive information unless it is reasonably necessary for, or directly related to, one or more of the entity's functions or activities. Sensitive information carries an additional requirement: consent, on top of the necessity test.
That is the pivot point most procurement processes skip. If your proctoring vendor runs facial matching at check-in, you are collecting sensitive information, and you need both a defensible necessity argument and genuine consent. Not consent buried in a 40-page enrolment agreement. Consent that a student could plausibly refuse without failing the unit, which means you need an alternative assessment pathway.
Ask yourself honestly: does a 30-minute formative quiz need biometric verification? Usually not. Does a final that feeds into professional registration? That is a much easier argument to make.
The statutory tort raised the cost of getting it wrong
Australia added a new avenue of individual redress in 2025, and it applies well beyond APP entities.
According to the OAIC, the statutory tort for serious invasions of privacy commenced on 10 June 2025 under Schedule 2 of the Privacy Act. It gives an individual a possible cause of action where they had a reasonable expectation of privacy and the defendant either intruded upon their seclusion or misused information about them. Courts can award damages, grant an injunction, or order an apology. Proceedings generally have to start within one year of the plaintiff becoming aware of the invasion, or three years from when it occurred, whichever is earlier.
Read the phrase "intruding upon the individual's seclusion" alongside a webcam in a student's bedroom and the relevance is obvious.
This does not make remote proctoring unlawful. It does mean proportionality is now a litigation question and not only a policy one. Continuous room-scan video for a low-stakes quiz was always poor practice. It is now poor practice that can end up in court.
TEQSA sets the integrity expectation, and it does not go away online
The regulatory pressure runs in the opposite direction from the privacy pressure, which is what makes this genuinely hard.
TEQSA operates under the Higher Education Standards Framework (Threshold Standards) 2021, and its position is that providers must assure academic and research integrity in all environments, including online. TEQSA maintains a body of resources on assessments and academic integrity, covering strategies for online invigilated exams, defending assessment design against e-cheating, and detecting contract cheating in online assessment.
So the provider obligation is real. You cannot resolve the tension by simply collecting less and hoping. You resolve it by matching the monitoring tier to the assessment's actual risk, and documenting why.
Data residency and the ANZ question
Every Australian tender asks it: where is the data stored?
The Privacy Act does not mandate onshore storage for higher education generally, but APP 8 governs cross-border disclosure and, in practice, university privacy offices and state-based obligations often push toward regional hosting anyway. Students ask too, and "somewhere in North America" is an unsatisfying answer to give an eighteen-year-old whose bedroom you just recorded.
The questions worth putting in writing:
- Where are session recordings stored at rest, and where are they processed?
- Which subprocessors have access, and are they listed?
- What is the retention period, what triggers deletion, and is deletion verifiable?
- Who inside the vendor can view a recording, and are those staff background-checked?
- Does each institution get a separate account, or is data commingled?
Vendors serious about regulated workloads can answer these precisely. Proctor360 keeps each organisation's data in a segregated storage account, background-checks proctoring staff, and conducts regular internal and external security penetration and load tests. For the most tightly regulated content it operates a dedicated GovCloud environment with US-citizen, data-security-trained proctors, which illustrates the level of hosting segregation that is achievable when a programme requires it. It holds SOC 2 Type I, GDPR and FERPA compliance.
Time zones, remote regions, and the operational reality
Australia is not a single-clock country, and its universities do not serve a single-clock student body.
An exam window set in AEST lands awkwardly in Perth and absurdly for a student in Jakarta or Dubai. Regional and remote students often work on satellite or fixed-wireless connections where a 30-second dropout is routine rather than exceptional. Students on placement in rural hospitals sit exams from staff accommodation with shared common areas.
Three design consequences follow.
Support has to be around the clock and matched to the tier. Live sessions need a proctor who can respond inside the session, and AI-only sessions need a fast, defined reply path. A candidate who fails check-in at 11 pm AWST needs an answer measured in minutes, not one that waits in a queue until morning.
Sessions must survive connection loss. If the platform voids an attempt after a brief dropout, you are punishing geography rather than misconduct. Test this on a deliberately throttled link during evaluation.
The flag threshold must account for shared living. A model tuned for a private study is going to light up every share house in Fitzroy. Human review of every incident is the only workable answer, and it should be resourced before the exam period, not after.
What a serious proctoring vendor should provide
Requirements first, product second.
Tiered security matched to assessment risk. Low-stakes quizzes and licensure exams should not receive the same configuration. Proctor360 offers five service tiers: AI Auto-Proctoring for high-volume automated monitoring, AI Auto-Proctoring with Intervention, Single Webcam Live with real-time intervention, Multi-Cam Live, which uses the candidate's phone as a second angle, and Institutional SaaS Remote Proctoring for institutions that prefer to proctor their own candidates with their own staff. The 360° Total View™ headset covers the highest-stakes sittings.
Hardware-level monitoring where it is justified. A patent-pending 360° Total View™ headset with camera, microphone and speaker captures the whole room rather than a webcam cone, and it works for paper exams as well as online ones. That matters for professional bodies still running written papers.
Documented compliance posture. Proctor360 holds SOC 2 Type I, GDPR and FERPA compliance, and can supply evidence of penetration testing, which gives your privacy office something to actually assess. Each camera in a multi-cam session is recorded as its own view, and default retention is six months.
Human oversight in the loop. Live proctors who can speak to a candidate and resolve ambiguity in the moment prevent a large share of downstream integrity cases.
Integration that does not break your workflow. Eleven named LMS and test-engine integrations, plus support for most common platforms and third-party test publishers.
Support quality you can verify independently. Proctor360 is rated 4.9 out of 5 on G2 across 14 reviews and 5.0 out of 5 on Gartner Peer Insights across 3 ratings, ranked first for service and support among remote proctoring vendors.
Frequently Asked Questions
Is online proctoring legal in Australia?
Yes. It must comply with the Privacy Act 1988 and the Australian Privacy Principles, which means collection must be reasonably necessary for your functions and, where biometric verification is used, supported by consent. Since 10 June 2025 individuals also have a statutory tort available for serious invasions of privacy, so proportionality matters more than it used to.
Is facial recognition at exam check-in allowed?
Biometric information used for automated verification is sensitive information under the Privacy Act, so APP 3 requires consent in addition to the necessity test. Practically, that means offering a non-biometric alternative and reserving biometric verification for assessments where the stakes justify it.
Does exam data have to be stored in Australia?
There is no blanket onshore storage requirement in the Privacy Act for higher education, but APP 8 governs cross-border disclosure and many institutional policies and state obligations push toward regional hosting. Confirm your own institution's position and write the answer into the contract.
How does TEQSA view online invigilated exams?
TEQSA expects providers to assure academic integrity across all delivery environments and publishes resources on strategies for online invigilated exams and defending assessment against e-cheating. Remote proctoring is one available control, not a mandated one, and assessment redesign sits alongside it.
What happens when a regional student's connection drops mid-exam?
A properly built system reconnects and preserves the evidence rather than voiding the attempt. Proctor360's platform attempts an automatic reconnect if a student's connection drops, and a pre-exam system check tests bandwidth, camera, microphone, browser extension and operating system before the session starts. Ask vendors to demonstrate this on a throttled connection before signing, because for students on satellite or fixed-wireless links it will happen.
Can proctoring software handle students in different time zones?
Only if the support model does. Australia spans multiple time zones before you count students sitting overseas, so around-the-clock support and flexible exam windows are operational requirements rather than nice-to-haves.
Get the proportionality argument right first
The universities that run remote proctoring well in Australia are not the ones with the most sensitive detection models. They are the ones that can explain, per assessment, why the monitoring level they chose was necessary. That explanation is what satisfies a privacy officer, a student complaint, and a regulator.
If you are reviewing options for the next exam period, schedule a demo and talk to the team about which of your assessments genuinely need which tier.
Sources
- Chapter B: Key concepts, APP Guidelines, Office of the Australian Information Commissioner
- Chapter 3: APP 3 Collection of solicited personal information, Office of the Australian Information Commissioner
- Statutory tort for serious invasions of privacy, Office of the Australian Information Commissioner
- Assessments and academic integrity, Tertiary Education Quality and Standards Agency
- GovCloud Remote Proctoring, Proctor360
- AI Auto-Proctoring, Proctor360
- 360° Total View™, Proctor360
- Integrations, Proctor360
- Book a Demo, Proctor360
Kranthi Bathula is the Co-Founder and CTO of Proctor360 and an online proctoring and assessment-security expert with extensive experience in EdTech, exam integrity, and AI-enabled test monitoring. He writes about remote proctoring, test security, AI in assessments, live and automated proctoring, and best practices for secure online testing. Through his engineering-driven insights, Kranthi helps educational institutions, certification bodies, and employers make informed decisions to protect the integrity of their exams.
