Is Online Webcam Proctoring Legal in India?
Short answer: webcam proctoring is not banned in India, but it is regulated personal-data processing under the Digital Personal Data Protection (DPDP) Act, and webcam plus face analysis raises the bar significantly. For most coaching centres and colleges, the simpler and safer path is to avoid collecting that data at all.
What does the DPDP Act require for webcam proctoring?
Recording a student's webcam and analysing their face is processing personal — and arguably sensitive — personal data. Under the DPDP Act you need a clear lawful basis, almost always specific, informed, freely given consent for that exact purpose. Blanket or bundled consent ("agree to everything to take the test") does not satisfy the law. You also owe data-minimisation, a defined retention period, security safeguards, and the ability to honour a student's rights over their data. That is real compliance work for what is meant to be a routine test.
Is webcam recording of students "sensitive" data?
Face data used to identify or analyse a person behaves like biometric data, which sits at the most sensitive end of the spectrum. The more identifying the data, the heavier your obligations and the bigger the consequences of a breach. A coaching centre that records thousands of students is holding a sensitive dataset it must now secure, justify and eventually delete — a liability most centres never wanted.
Can students refuse webcam proctoring?
Because the lawful basis is consent, students can decline, and you must offer a workable alternative rather than forcing the camera as the only option. In practice many students and parents object on privacy grounds, which leaves institutions managing complaints and exceptions. Designing the assessment so it never needs a webcam sidesteps the whole problem.
What is a DPDP-friendly alternative?
The cleanest compliance posture is to not collect the risky data in the first place. ExamGuard Online proctors in the browser with no webcam, no recording and no biometric data — it scores in-browser behaviour (tab-switching, copy/paste, screenshot presses) and watermarks each screen for traceability. Less data collected means less consent friction, less retention risk and a far smaller breach surface. It is also local-first and self-hostable, so student data can stay on your own infrastructure.
This is general information, not legal advice — confirm specifics with a qualified advisor.
