How long are AI-proctored exam recordings stored, and who can access them?
TL;DR: There's no universal legal deadline, but two principles should drive the policy: keep recordings only as long as they're needed for grading, appeals, or accreditation review (GDPR's "storage limitation" principle), and restrict access to instructors, integrity officers, and the student involved. Set and publish a specific retention period rather than storing everything indefinitely by default.
The Evidence
Two regulatory frameworks shape this even for US institutions with international students: GDPR's storage-limitation principle requires that personal data — which includes proctoring video and biometric identity data — be kept "no longer than is necessary" for the purpose it was collected for. FERPA, meanwhile, treats exam recordings as part of a student's education record, governing who can access them (the student, school officials with a legitimate educational interest) rather than dictating a specific retention window itself.
In practice, this means most institutions land on a policy like: keep recordings through the grading period and any appeal window — commonly weeks to a few months — then delete, unless a specific case (an active academic-integrity investigation, an accreditation audit) requires longer retention. Indefinite, unbounded retention "just in case" is the pattern that draws the most privacy criticism and the most regulatory risk, because it keeps sensitive biometric data around long after its original purpose has passed.
Who Should Have Access
| Role | Typical access |
|---|---|
| The student | Can request to view their own flagged evidence |
| Instructor / hiring manager | Access to sessions for their own course or role |
| Academic integrity office / HR | Access when a case is escalated |
| IT / vendor admin | Technical access only, not evidentiary use |
| Third parties | No access without a specific legal basis or student consent |
How to Set a Sound Retention Policy
- Define a default retention window tied to your grading and appeals timeline — not "forever."
- Extend retention only for sessions tied to an active misconduct case, and document why.
- Restrict access by role — instructors see their own course, integrity officers see escalated cases.
- Publish the retention policy to students and candidates before they're recorded.
- Confirm your vendor supports configurable, auditable deletion — not just a promise in a privacy policy.
FAQ
Does GDPR apply if my institution is US-based? It applies if you have EU/UK students or candidates, or in some interpretations if you process their data — check with counsel if you have any international test-takers.
Can a student request their own recording be deleted? Generally not while it's needed for grading, appeals, or an open case; after that window, many institutions honor deletion requests consistent with their published policy.
What retention period does Neuroxa support? Neuroxa's trust reports and evidence are retained on a configurable schedule set by the institution, so retention matches your grading and appeals timeline rather than a fixed default.
Is longer retention ever justified? Yes — an active misconduct investigation, litigation hold, or accreditation review can justify extending retention for specific sessions, documented and time-bound.
By Pinal Dave Last updated: 2026-07-25