Know what counts as personal data
Names, contact details, exam results, ID images, recordings, screenshots and device information can all identify a person.
DPDP ACT FOR SCHOOLS & EXAMSProtect the exam.
Protect the exam.
Respect the person.
The Digital Personal Data Protection Act changes the way institutions handle candidate data. Here is a practical view of the law, the exam data journey, and what ProctorPlus currently says about protecting it.
An exam data journeyFrom invitation to retention
Identity and contact detailsBefore
Camera, audio and screen evidenceDuring
Results and review recordsAfter
Access and erasure requestsLater
Use the controls and retention terms that fit your assessment.
THE LAW IN PLAIN WORDS
What the DPDP Act asks of exam teams.
Schools and assessment providers work with more than marks. An online exam can involve a candidate’s identity, surroundings and behaviour, so its data flow needs a clear purpose and careful handling.
Phased commencement13 Nov 2025 Initial provisions and Rules notified13 Nov 2026 Consent Manager provisions13 May 2027 Most remaining provisions
Take extra care with children
For a candidate under 18, the Act generally calls for verifiable consent from a parent or lawful guardian before processing their data.
Make the purpose clear
People should be told what data is collected, why it is needed, and how they can exercise their rights.
Protect and limit access
Reasonable safeguards, access controls, records and a plan for handling a personal data breach matter throughout the exam.
Keep data only as needed
Retention should reflect the stated purpose, institutional requirements and any applicable legal obligation.
Be ready for requests
Candidates or parents may seek access, correction, erasure or grievance redressal under the Act, subject to its conditions.
Timeline and rule summaries are based on the official commencement notification and the DPDP Rules, 2025. Your legal adviser should assess your particular use case.
THE LIFE OF EXAM DATA
Six stages. One accountable process.
Follow an illustrative candidate through a remote assessment. The exact data and settings depend on the institution’s exam configuration.
DATA JOURNEYCandidate
Candidate
exam record
- Purpose
- Deliver and review an assessment
- Institution
- Defines the exam and its requirements
- Platform
- Processes the configured exam data
STAGE 01 · Before the exam01 / 06
Explain and prepare
Tell candidates what the assessment requires, including identity checks, camera, microphone or screen access when enabled. The institution should identify the purpose and its consent basis.
Notice & purpose
STAGE 02 · For minors02 / 06
Confirm parental consent
If an institution invites a learner under 18, its policy and the law require valid parental or guardian consent before that learner uses ProctorPlus.
Institution responsibility
STAGE 03 · During the exam03 / 06
Collect what the exam needs
Depending on the configured assessment, ProctorPlus may process identity details, live camera or audio, screenshots, activity events and device information for exam integrity.
Exam data
STAGE 04 · After the exam04 / 06
Review with controlled access
Authorized institution staff can review relevant session evidence and results. ProctorPlus describes role based access, logging and monitoring in its privacy policy.
Access control
STAGE 05 · When asked05 / 06
Handle rights requests
A candidate or parent can ask about their data. ProctorPlus provides a privacy contact; the institution should also have a process for requests concerning its exams.
Rights & grievances
STAGE 06 · At the end06 / 06
Apply the retention period
Exam media is typically kept for a limited period, with longer retention possible for disputes, investigations or legal duties. The applicable policy and institutional agreement govern deletion.
Retention
SHARED RESPONSIBILITYYour institution sets the exam.
Your institution sets the exam.
We help run it securely.
The legal role of each party depends on the arrangement and the data involved. These are practical responsibilities to define in your agreement and operating process.
Your institution
Choose what the exam needs, give candidates the right notices, handle minor consent where applicable, set access and retention requirements, and respond to requests about the exam.
ProctorPlus
Operate the assessment platform and apply the privacy and security practices described in our policy. Work with the institution on the data and support needed for its exam process.
DecisionInstitutionProctorPlus
Exam purposeDefines assessment and required evidenceProcesses the configured workflow
MinorsObtains valid parental or guardian consentRequires institutional authorization under its policy
AccessChooses authorized reviewersApplies role based platform controls
RequestsHandles exam related decisionsProvides a privacy and grievance contact
WHAT OUR POLICY SAYS TODAY
Privacy practices you can check.
These points come from ProctorPlus’s published privacy policy. Your contract and the exam configuration determine the details for your institution.
Encryption in transit
The privacy policy describes encryption while personal data moves between systems.
Role based access
Access to personal data is restricted to authorized people and service providers with a need to perform their work.
Logging and monitoring
ProctorPlus describes operational logging, monitoring and regular security reviews.
Limited retention
The privacy policy gives typical periods for exam media and event logs, with exceptions for legitimate needs.
No sale of personal data
ProctorPlus says it does not sell personal information or give it to third parties for their own direct marketing.
Documented privacy route
Candidates can use the privacy policy to find the process for access, correction, erasure and grievances.
CHILDREN FIRST
Extra care when a candidate is under 18.
Online proctoring can process images, audio and activity data. For a minor, make the assessment and its data collection clear to a parent or guardian before the exam begins.
- Verify the institution’s parental consent process.
- Review which monitoring settings are genuinely needed.
- Explain who reviews evidence and how long it is kept.
Under 18?
ProctorPlus’s privacy policy says institutions must obtain valid, verifiable parental or guardian consent before enabling minors to use the platform.
See the policyYOUR NEXT STEPS
A short checklist before your next exam.
Use this conversation starter with your data protection, academic and IT teams. It is a planning aid, not a substitute for legal review.
Discuss your workflowEXAM DATA CHECKLIST04 ITEMS
- 01
Map the data
List the identity, media, result and device data each exam uses.
- 02
Set notices and consent
Make the purpose clear and confirm a process for minors.
- 03
Assign access and retention
Choose reviewers, timelines and escalation contacts.
- 04
Review the agreement
Align the contract and platform settings with your policy.
QUESTIONS
Questions schools ask about DPDP.
Answers based on the official Rules and the current ProctorPlus privacy policy.
Does the DPDP Act apply to online exams?
It can. Online exams commonly involve digital personal data such as names, identity images, recordings, results and device information. The institution should map the specific data and purposes in its assessment workflow.
Is ProctorPlus “DPDP certified”?
There is no official DPDP certification to rely on here. Review the applicable law, the ProctorPlus privacy policy, your agreement and the actual controls configured for your exams.
Who gets consent for a learner under 18?
The ProctorPlus privacy policy says institutions administering assessments to minors are responsible for obtaining valid, verifiable parental or guardian consent before enabling use.
What does ProctorPlus collect during an exam?
The data depends on the assessment settings. The privacy policy lists identity and contact details, exam related photos, audio, video or screenshots, and device and activity information among the possible categories.
How long are recordings kept?
The privacy policy says exam media is typically retained for a limited period, for example up to three months, while related metadata may be retained somewhat longer. Investigations, disputes, legal duties or an institutional agreement can change the period.
Can a candidate request deletion?
The privacy policy describes requests for access, correction and erasure, subject to legal and contractual limitations. Use the contact details in that policy, and involve the institution responsible for the exam.
SEE IT IN CONTEXT
Talk through your exam data flow.
We can show you how ProctorPlus supports your assessment and discuss the controls, evidence and retention questions that matter to your team.