Not legal advice. This template reflects the GDPR and supervisory authority guidance as of 6 November 2026. Adapt it with your data protection officer.
A data protection impact assessment (DPIA) is required under the GDPR when processing is likely to result in a high risk to people's rights and freedoms, and online proctoring usually qualifies: it systematically monitors students, who cannot easily refuse, using camera, microphone and new technology. This article gives you a section-by-section template with prompts to fill in, a worked illustration comparing two proctoring architectures, and a one-page checklist. A downloadable version of the template is at the end.
When a DPIA is required, and why proctoring usually triggers one
Article 35(1) of the GDPR requires the controller to carry out a DPIA, before processing, where a type of processing, particularly one using new technologies, is likely to result in a high risk to the rights and freedoms of natural persons. Article 35(3) lists cases where one is always required, and national supervisory authorities publish their own lists under Article 35(4).
The deciding guidance is the WP29 Guidelines on DPIA (WP248 rev.01), endorsed by the European Data Protection Board. They list nine criteria and state that "in most cases" processing meeting two of them requires a DPIA. Proctoring tends to meet several:
| WP248 criterion | How proctoring commonly meets it |
|---|---|
| Systematic monitoring | Continuous observation of candidates throughout an exam |
| Vulnerable data subjects | The guidelines name cases where there is an imbalance between data subject and controller; students facing an exam are a clear example |
| Innovative use of technology | Automated analysis of video, audio or behaviour |
| Evaluation or scoring | Integrity or risk scores per session |
| Sensitive data or data of a highly personal nature | Images of a person's home; possibly biometric data if faces are compared for identification |
| Large-scale processing | Every candidate in a cohort, every exam period |
| Prevents use of a service | A flag can affect access to a qualification |
Universities' own guidance agrees: the University of York says a DPIA must be carried out before the processing begins, and Loughborough University's DPIA process explicitly asks for an assessment of power imbalances between controller and data subjects.
The template, section by section
Article 35(7) sets the minimum content of a DPIA: a description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of the risks to data subjects, and the measures to address them. The sections below follow that structure and add the practical parts a proctoring DPIA needs.
1. Description of the processing
Fill in:
- Purpose. Which integrity risks are you addressing, for which exams? ("Impersonation and unauthorised assistance in remote final exams for programme X.")
- Data categories. For each: video, audio, screen, device information, keystroke or input events, identity documents, reference photos, event logs, scores, reviewer notes.
- Where processing happens. On the candidate's device, on the vendor's servers, on your systems? Which data leaves the device, and in what form?
- Recipients. Reviewers, administrators, the vendor, its sub-processors, AI providers. Attach the vendor's sub-processor list.
- Retention. How long each category is kept, and what deletes it.
- Data flow diagram. Ask the vendor for one, and keep it in the DPIA.
2. Necessity and proportionality
- Why is proctoring needed for this exam? Could assessment design (open-book, oral, project work) achieve the purpose with less intrusion?
- Which features are switched on, and why each one? Record why a less intrusive option was rejected.
- Is the monitoring level matched to the exam's stakes?
- Is every automated flag reviewed by a person before any consequence?
3. Lawful basis
- Identify the Article 6 basis. Public institutions often look to a task carried out in the public interest; private providers to contract or legitimate interests. Take your DPO's view.
- Consent is usually the wrong basis. The EDPB's guidelines on consent explain (paragraphs 16 to 24) that a clear imbalance of power, as with public authorities and employers, makes freely given consent unlikely, and that such imbalances are not limited to those cases. A student who must accept proctoring to sit an exam is not making a free choice.
- If any special-category data is processed (for example biometric data used to identify a person), identify the Article 9 condition as well.
- Record what alternative you offer students who object. It should not put them at a disadvantage, for example by delaying their studies.
4. Risks to students
Assess likelihood and severity for each, from the student's point of view:
- Exposure of private home life on camera.
- Misuse or breach of video, audio or biometric data.
- Wrongful accusation from a false flag, and its effect on studies and wellbeing.
- Bias: worse detection accuracy for some groups, lighting conditions, disabilities or neurodivergent behaviour.
- Exclusion of students without a suitable device, camera or connection.
- Anxiety and its effect on performance.
- Function creep: data reused for purposes beyond exam integrity.
5. Mitigations
For each risk, record the measure and the residual risk. Typical measures:
- Architecture: analyse video and audio on the device and transmit only events, so no video is uploaded.
- Minimisation: enable only the signals the exam needs.
- Retention: the shortest period that covers your appeal window, with automatic deletion.
- Human review: no consequence without a person reviewing the evidence, and a documented appeal route.
- Transparency: a plain-language notice to students before the exam, explaining what is and is not monitored.
- Contract: a data processing agreement meeting Article 28, sub-processor notice, EU hosting where required.
- Accessibility: accommodations applied without disclosing disabilities to the vendor.
6. Consultation
- DPO: involved from the start, not informed afterwards. Record their advice and whether you followed it.
- Students and staff: Article 35(9) asks controllers to seek the views of data subjects where appropriate. Student councils are a practical route.
- Supervisory authority: if high residual risk remains after mitigation, Article 36(1) requires prior consultation before processing.
7. Sign-off and review
- Who approved the DPIA, on what date, with which residual risks accepted.
- A review date, and the triggers for an earlier review: a new vendor version, a newly enabled feature, a new exam type. Article 35(11) requires review at least when the risk changes.
- If the tool is an AI system used to monitor students during tests, note that the EU AI Act treats it as high-risk and that Article 26(9) expects deployers to use the provider's information in this DPIA. As amended in 2026, those high-risk obligations apply from 2 December 2027.
Worked illustration: two architectures
The comparison below is illustrative. It shows how architecture changes the risk section of a DPIA, using two generic designs rather than any specific product.
| DPIA question | Design A: video uploaded for review | Design B: on-device analysis, events only |
|---|---|---|
| What leaves the device? | Continuous video and audio, possibly screen | Event records: type, time, duration |
| Server-side sensitive data | Hours of footage per student, showing their home | No footage |
| Breach impact | High: intimate images and audio | Lower: a log of exam events |
| Retention burden | Video storage, deletion across backups | Event logs with automatic deletion |
| Biometric questions | Possible, depending on server-side analysis | Reduced; check any identity comparison feature |
| Evidence for appeals | Footage | Timestamped events |
| Residual risk (typical) | Medium to high | Low to medium |
Design B does not remove the need for a DPIA: it is still systematic monitoring of students. What it changes is the size of the risks you have to mitigate. Our Article 25 privacy-by-default guide explains why the default configuration matters as much as the architecture.
One-page checklist
- Purpose stated per exam type
- Every data category listed, with where it is processed and for how long it is kept
- Data flow diagram and sub-processor list attached
- Less intrusive alternatives considered and the reason for rejecting them recorded
- Each enabled feature justified; no video uploaded unless strictly necessary
- Lawful basis recorded; consent not relied on where students cannot refuse
- Article 9 condition recorded if special-category data is processed
- Alternative arrangement for students who object
- Risks assessed from the student's perspective, including bias and exclusion
- Human review before any consequence; appeal route documented
- Student notice drafted in plain language
- Data processing agreement signed
- DPO advice recorded; students or their representatives consulted
- Residual risk accepted by a named owner, or prior consultation started
- Review date and change triggers set
Download the template
The template is available as a Markdown file you can copy into your own DPIA format. The CNIL also offers free, open-source PIA software and guides that structure the same assessment. To check a vendor before you start, use our DPO audit blueprint for proctoring vendors.
How ProctorSafe supports your DPIA
ProctorSafe analyses video and audio in the candidate's browser. Video is not uploaded: only integrity events are sent to its servers, hosted by AWS in Paris. You set how long session data is kept, up to a maximum of 90 days, and it is then deleted automatically. Every flag is evidence on a timeline for a person to review. Our GDPR-compliant proctoring overview describes the data flows, and our published sub-processor list names every third party involved. To see what candidates experience, try the candidate demo.