Klarway and GDPR: proctoring with biometric data in compliance with EU regulation
Updated April 23, 2026
In summary
Klarway processes biometric data under GDPR acting as data processor under the institution's instructions. Data is encrypted in transit and at rest, retention is configurable, and the DPA is available on request.
What data does Klarway process during a supervised exam?
Klarway processes three categories of data during a proctoring session. The first is biometric data: facial images captured for identity verification and biometric comparisons that confirm the person in front of the camera matches the prior registration. These are specially protected data under Art. 9 of the GDPR.
The second category is audio and video data: the recording of the exam session that the system analyzes to detect anomalies. The third category is contextual data: information about on-screen activity (open tabs, active applications) depending on the rigor level configured by the institution for each exam.
Klarway does not process health data, data about beliefs or affiliations, or data of children under 16 without parental consent. Processing is strictly limited to the context of the supervised exam.
What role does the institution play and what role does Klarway play?
Under GDPR, the educational institution acts as data controller: it decides what data is collected, for what purpose, for how long and with what restrictions. Klarway acts as data processor: it processes data following the institution's instructions and within the limits of the DPA.
This distinction has practical implications: the institution must inform the student about the use of proctoring, obtain consent, and respond to the student if they exercise their rights. Klarway is contractually obligated not to use data for any other purpose and to notify the institution of any security breach.
Klarway's standard DPA covers these responsibilities comprehensively and is available on request. In cases where the institution has its own data processing agreements, Klarway can review and adapt the terms in consultation with the legal team.
How is student consent obtained?
Consent for processing biometric data must be informed, specific and explicit. The institution is responsible for incorporating information about the use of proctoring into the terms and conditions the student accepts upon enrollment, and for obtaining specific consent before the first supervised exam.
Klarway provides a standard consent screen that the student sees before starting the exam, describing what data will be collected and for what purpose. This consent is timestamped and logged as part of the session report.
For exams where the student does not give consent, the system blocks them from accessing the exam and notifies the institution to manage the situation according to its academic policies. Klarway does not force access or record data from students who have not consented.
GDPR and proctoring
More on compliance
Protect the integrity of your assessments
A Klarway specialist will be in touch with you shortly.