# DPIA template: online proctoring

Data protection impact assessment template for online exam proctoring.
Published by ProctorSafe. Free to copy and adapt. Not legal advice: complete it with your data protection officer.

Structure follows Article 35(7) GDPR and the WP29 Guidelines on DPIA (WP248 rev.01), endorsed by the EDPB.

---

## 0. Document control

| Field | Entry |
|---|---|
| Processing name | |
| Controller | |
| DPO | |
| Owner (exam / programme) | |
| Version and date | |
| Next review date | |

## 1. Screening: is a DPIA required?

Tick each WP248 criterion that applies. Two or more usually means a DPIA is required.

- [ ] Evaluation or scoring (e.g. integrity or risk scores)
- [ ] Automated decision-making with legal or similarly significant effect
- [ ] Systematic monitoring (continuous observation during the exam)
- [ ] Sensitive or highly personal data (home environment, biometric data)
- [ ] Large-scale processing (whole cohorts, every exam period)
- [ ] Matching or combining datasets
- [ ] Vulnerable data subjects / imbalance of power (students)
- [ ] Innovative use of technology (automated video, audio or behaviour analysis)
- [ ] Processing that prevents use of a service (affects access to a qualification)

Conclusion:

## 2. Description of the processing

| Item | Entry |
|---|---|
| Purpose (which integrity risks, which exams) | |
| Exams and populations in scope | |
| Data categories (video, audio, screen, device info, input events, ID documents, reference photos, event logs, scores, reviewer notes) | |
| Where each category is processed (device / vendor / own systems) | |
| What leaves the candidate's device, in what form | |
| Recipients (reviewers, admins, vendor, sub-processors, AI providers) | |
| Retention per category, and deletion mechanism | |
| Hosting location and international transfers | |
| Data flow diagram attached? | |

## 3. Necessity and proportionality

| Question | Answer |
|---|---|
| Why is proctoring needed for these exams? | |
| Less intrusive alternatives considered (assessment design, supervised venue, oral exam) and why rejected | |
| Features enabled, with justification for each | |
| Features deliberately disabled (e.g. video upload, room scan) | |
| Is monitoring intensity matched to exam stakes? | |
| Is every automated flag reviewed by a person before any consequence? | |

## 4. Lawful basis

| Question | Answer |
|---|---|
| Article 6 basis | |
| Why consent is / is not appropriate (imbalance of power, ability to refuse) | |
| Article 9 condition, if special-category data (e.g. biometric identification) | |
| Alternative offered to students who object, and its effect on their studies | |

## 5. Risks to data subjects

Score likelihood and severity (low / medium / high) from the student's point of view.

| Risk | Likelihood | Severity | Notes |
|---|---|---|---|
| Exposure of private home life | | | |
| Breach or misuse of video, audio or biometric data | | | |
| Wrongful accusation from a false flag | | | |
| Bias across groups, lighting, disability, neurodivergence | | | |
| Exclusion of students without suitable device or connection | | | |
| Anxiety affecting performance | | | |
| Reuse beyond exam integrity (function creep) | | | |
| Other | | | |

## 6. Measures and residual risk

| Risk | Measure | Residual risk | Owner |
|---|---|---|---|
| | On-device analysis; events only transmitted | | |
| | No video upload; events only | | |
| | Shortest retention covering the appeal window; automatic deletion | | |
| | Human review and documented appeal route | | |
| | Plain-language student notice before the exam | | |
| | Data processing agreement (Art. 28) and sub-processor notice | | |
| | Accommodations applied without disclosure to the vendor | | |
| | | | |

## 7. Consultation

| Party | Date | Advice / views | How addressed |
|---|---|---|---|
| DPO | | | |
| Students or their representatives (Art. 35(9)) | | | |
| Teaching staff | | | |
| IT / information security | | | |
| Supervisory authority (Art. 36, if high residual risk) | | | |

## 8. AI Act (if the tool is an AI system monitoring students during tests)

| Question | Answer |
|---|---|
| Vendor's classification under Annex III, point 3(d) | |
| Confirmation that no feature infers emotions (Art. 5(1)(f)) | |
| Instructions for use and information received for this DPIA (Art. 26(9)) | |
| Human oversight arrangements (Art. 26(2)) | |
| Fundamental rights impact assessment needed? (Art. 27) | |

## 9. Sign-off

| Field | Entry |
|---|---|
| Residual risks accepted | |
| Approved by (name, role) | |
| Date | |
| Review triggers (new vendor version, new feature, new exam type) | |
| Next scheduled review | |