How long should remote exam recordings and proctoring data be kept?
What the data actually includes
A typical proctored session can hold webcam and screen recordings, room scan footage, chat logs with proctors, identity document images, and system flags with reviewer notes. Each element has a different sensitivity and a different reason to exist, so a single keep everything for years rule applied to all of it is laziness, not caution.
Identity documents deserve the shortest leash. Once identity is verified and any appeal window closes, the case for keeping a copy of a passport image weakens sharply, while the harm from its breach stays exactly as large as the day it was captured.
Set retention by purpose, then by clock
Work backwards from the processes the data serves: the appeals deadline, the period in which results can be challenged, accreditation sampling, and any legal hold duties. The longest of those sets the outer limit for the full record; elements not needed for all of them should fall away earlier on their own schedules.
Publish the schedule where candidates will actually read it: what is kept, for how long, and who can access it. A retention policy that exists only in a vendor contract the candidate never sees does no work for trust, which is half the point of having one.
Access control is part of retention
Data kept safely is data with named access: which staff roles can view recordings, for what reasons, with logging of who viewed what. Footage reviewed casually, shared in training decks without need, or accessible to broad staff groups is a breach waiting for its occasion, regardless of the deletion date on paper.
Vendor terms need the same scrutiny. Where recordings are stored, which subprocessors touch them, whether data trains any models, and what deletion certification the vendor provides at contract end should all be written answers, not sales assurances.
Candidate rights and deletion requests
Privacy law in many places gives candidates rights to see, correct, and in some cases delete their data, balanced against the institution's need to defend results. Institutions should have a rehearsed answer for such requests that separates what can be deleted now, what must be held until a date, and why, in plain language a candidate can act on.
Deletion must reach backups and vendor systems on a defined cycle, or it is theatre. Record the deletion, not just the request: date, scope, and systems covered, so the institution can prove its policy is a practice.
Review the policy as the technology changes
New proctoring features, such as biometric voice or face matching, add data types the original policy never contemplated. Each feature adoption should trigger a retention and consent review before it is switched on for live candidates, not a policy patch after a complaint.
An annual review with the appeals team, data protection lead, and candidate representatives where they exist keeps the schedule honest. Retention periods set once and never revisited drift toward keeping everything forever, which is the one outcome nobody chose on purpose.
Keep reading: How do candidates bypass browser lockdown tools during remote exams?, How should testing programs run a fair appeals process for flagged exam results?, and How should testing programs verify candidate identity without making check in a nightmare? cover the nearby cases in this series.
Frequently asked questions
Why does proctoring data retention matter so much?
Because proctoring records include video of candidates' homes, audio, screens, and identity documents. Keeping that material longer or more loosely than needed creates breach harm without any remaining purpose, while deleting too early undermines appeals.
How long should exam recordings be kept?
As long as the processes they serve require: appeals and result challenge windows, accreditation checks, and legal duties, with the longest setting the outer limit. Identity documents usually justify a shorter period than session records.
Who should be able to view proctoring recordings?
Only named staff roles, for defined reasons such as reviewing a flag or an appeal, with access logged. Broad or casual access is a misuse risk regardless of how secure the storage itself is.
What should a candidate be told about their proctoring data?
What is collected, how long each type is kept, who can access it, and what rights they have over it, published before the exam in plain language. A policy hidden in a vendor contract does no work for trust.