Data minimization
Keep a record of the purpose and necessity of each type of data: camera, audio, screen, and behavioral data.
BLOG
Candidate Privacy in Proctoring Systems: KVKK Checklist (2026 Guide)
Review proctoring data under the headings of purpose, access, retention, and human oversight.
First, a note on scope: This guide is not legal advice. Verify your proctoring workflow with your institution’s legal department, the data controller/processor roles, and current KVKK requirements.
Access and retention
Clearly define encryption, authorization, access to recordings, and deletion periods at the contract and policy levels.
Candidate rights
Design privacy notices, objection procedures, and alternative processes together with your legal/compliance team.
Remote exam proctoring systems collect camera recordings, audio, screenshots, and behavioral data. This data may often qualify as personal or sensitive data and may require special protection under KVKK. Failure to ensure compliance can harm candidate rights and create administrative and reputational risks for the institution.
This guide provides a checklist and practical recommendations for evaluating proctoring solutions from a KVKK perspective. Each institution’s circumstances are different, so the recommendations should be confirmed with your institution’s legal department before implementation.
The content covers a broad range of topics, from legal bases for data processing and technical safeguards to data processing agreements, data ownership, and objection mechanisms.
The final section includes a call to action directing readers to information about QProctor’s compliance processes and contact details.
Data processing principles and legal bases
Data processing under KVKK must comply with the principles of transparency, explicit consent (or a legal basis), purpose limitation, and data minimization. In proctoring processes, assess which data is essential and which data can be replaced by alternative methods.
Technical and organizational measures
Minimum safeguards include data encryption (both in transit and at rest), authorization and access logs, regular penetration testing, and data access policies. Log and recording access should also be auditable, and unnecessary access should be prevented.
Contracts and processor oversight
Contracts with proctoring providers should clearly define data processor obligations, security standards, use of subcontractors, data breach notification procedures, and data deletion/obfuscation mechanisms.
Data Protection Impact Assessment (DPIA)
A DPIA is recommended in cases involving large-scale monitoring, sensitive data processing, or automated decision-making. A DPIA is a vital document that records risks, mitigation strategies, and responsible parties.
Checklist: KVKK compliance checklist
- Are privacy notices clear and accessible?
- Has the legal basis been correctly determined (consent or another basis)?
- Has a DPIA been conducted and documented?
- Are data processing agreements up to date and auditable?
- Are data retention periods and deletion procedures defined?
- Have security measures (encryption, access control, logging) been implemented?
- Are there procedures for candidates to exercise their data rights (access, objection, deletion)?
Note: KVKK interpretations and the technical solutions applied may change over time. Consult KVKK guidance and your institution’s legal counsel for definitive requirements.
Sources
Review QProctor’s scope together
Clarify product modules, data processing flows, and your institution’s human approval process through a demo.
Request a demo and informationRelated QProctor resources
Frequently Asked Questions
What is the first check for proctoring data?
The first step is to clearly document what data is processed, for what purpose, on what legal basis, and for how long.
How should access permissions be restricted?
Only people authorized by virtue of their role should be able to access recordings and risk reports; access should be logged and reviewed periodically.
What safeguards are described on QProctor product pages?
The official pages describe encrypted storage of recordings, authorized access, identity verification, and risk/anomaly reporting; institutional settings should be verified during the demo.
Let’s design your exam security together
Review the proctoring, identity verification, environment analysis, and reporting workflow suited to your institution with the QProctor team.
Cover: a conceptual illustration depicting the product theme; not an actual application screen.
