A request lands on the privacy officer's desk: a department wants to proctor its finals remotely, starting next session. At a cégep or university, that means recording students, often at home, with a tool the institution has not assessed yet. The CIO who will deploy it and the procurement lead who will tender it soon ask the same questions.
They come back before each exam period, when a pilot becomes the default, and at contract renewal. This checklist covers what remote proctoring collects, what Quebec's Law 25 generally expects and what to ask any proctoring vendor. It explains the law in general terms and is not legal advice: confirm how each obligation applies to your institution with your privacy officer or legal counsel.
What does remote proctoring collect?
Depending on the product and its settings, a proctoring tool can collect:
- Video and audio of the student, through the camera and microphone, often from a bedroom or a kitchen.
- Screen recordings of every connected monitor, which can capture notifications, file names and open tabs.
- Keyboard and mouse activity during the exam.
- Identity data: the student's account and, with some tools, a photo of an ID card or a face image compared with a reference.
- Event logs: sign-in, start and end times, applications opened, alerts raised.
- Exam and enrollment data from the student information system (SIS), and sometimes accommodation settings that can hint at a disability.
Some of this is sensitive. Law 25 treats personal information as sensitive when, by its nature (medical or biometric information, for example) or the context of its use, it carries a high reasonable expectation of privacy. Video of a student's home, a face template or an accommodation linked to a health condition can fall into that category. Accommodations need particular care, as accommodations in proctored online exams explains.
What does Law 25 expect from a proctoring project?
Law 25, adopted in 2021 to modernize Quebec's privacy legislation, amended both the act for public bodies, which generally covers cégeps and universities, and the act for private companies, which covers most vendors. Its obligations came into force in stages until 2024. For a proctoring tool, these points generally matter most.
- A privacy impact assessment (EFVP). A public body generally has to assess the privacy factors of any project to acquire or develop an information system that involves personal information, from early in the project.
- An assessment before information leaves Quebec. Before personal information is communicated outside Quebec, including to another province, the institution generally has to assess whether it will be adequately protected and back the communication with a written agreement.
- Only what is necessary. Personal information should be collected only when it is necessary for the purpose, here running and verifying an exam.
- Confidentiality by default. Where a technological product or service has privacy settings, Law 25 generally expects the most protective ones to apply by default. For proctoring, that points to enabling only the captures an exam needs.
- Retention and destruction. Information is kept only as long as its purpose requires, then destroyed securely or anonymized, in line with the institution's retention schedule.
- Confidentiality incidents. The institution must take reasonable measures to reduce the risk of injury, record each incident in a register and, when there is a risk of serious injury, promptly notify the Commission d'accès à l'information (CAI) and the people concerned.
- Transparency. Students should be told what is collected, why, who will see it and what their rights are. When a decision is based exclusively on automated processing, the person concerned must be informed.
- Biometrics. Verifying identity with biometric characteristics, such as facial recognition, generally requires the person's express consent and a declaration to the CAI before the process is put in place.
What it costs to get it wrong
- A delayed exam period. An EFVP started after the pilot, once students have already been recorded, can send the project back to the drawing board weeks before finals.
- Recordings nobody needs. Video kept for years after grades are final stays exposed to incidents long after it served its purpose.
- Incidents you cannot assess. If a vendor cannot say who opened which recording, the institution cannot judge the risk of serious injury, and may notify too broadly or too late.
- Student trust. A camera in a student's bedroom is a hard sell when students hear about it from a classmate first. Clear, early information is part of the obligation.
- Enforcement exposure. Law 25 strengthened the CAI's oversight powers and the penalties that can follow a breach of the law.
What doesn't work
Taking a compliance badge at face value. Compliance is the institution's obligation for a specific use. A vendor cannot be compliant on your behalf; it can only give your assessment the facts it needs.
Recording everything, just in case. Turning on every capture for every exam is the opposite of collecting only what is necessary. A multiple-choice quiz in a supervised computer lab rarely needs the camera that a remote final does.
Assuming Canada means Quebec. Law 25's rule on communication outside Quebec covers other provinces too. "Hosted in Canada" answers part of the question, not all of it.
Leaving retention at the default. If nobody sets a period, recordings tend to stay indefinitely. Retention is the institution's decision and belongs in its retention schedule.
Adding AI features without assessing them. Some proctoring tools analyze video with facial recognition or behavior models and produce a suspicion score. That can be a deliberate choice, but it brings biometric and automated-processing questions the EFVP has to answer. For the trade-offs, read remote exam proctoring without AI or facial recognition.
The proctoring vendor checklist
Use these questions in your call for tenders, vendor questionnaire and EFVP, and ask for written answers.
| Question for the vendor | Why it matters | What a good answer looks like |
|---|---|---|
| What exactly is collected, and can each capture be turned off? | Collection must be limited to what is necessary. | A complete list by data type, each capture switchable per exam, nothing recorded when switched off. |
| Where is data hosted and processed, including backups? | Information leaving Quebec needs its own assessment. | Named regions and environments, in writing, backups and support tools included. |
| Which subprocessors are involved? | Each one receives personal information and may be located elsewhere. | A complete list with each one's role and location, and notice before changes. |
| Who at the vendor can access recordings, and is access logged? | Access is where incidents start, and logs are how you assess them. | Support access only, on request, by staff in a known location, every access logged. |
| How long is data kept, and how is it deleted? | Information is kept only as long as needed, then destroyed securely. | Retention set by the institution, automatic deletion at expiry, deletion on request. |
| Does the product use biometric data or AI analysis? | Biometric verification adds consent and declaration duties; automated decisions add transparency duties. | A clear yes or no per feature; if yes, whether it can be turned off and what a person decides. |
| Is our data used to train AI models or for any other purpose? | Use should stay limited to the purpose of collection. | No secondary use and no sharing with third parties, written into the contract. |
| How is data protected? | Security measures should match the sensitivity of the information. | Encryption in transit and at rest, role-based access, complete access logging. |
| How and when will you notify us of a confidentiality incident? | The institution must assess the risk, record the incident and notify the CAI and the people concerned when required. | A documented process, notice without delay, enough detail to act. |
| What documentation can you provide for our EFVP? | The assessment needs facts about data flows and safeguards. | Data flows, privacy policy, security questionnaire answers and help with the EFVP. |
Four decisions stay with the institution, whatever the tool: which captures each type of exam needs, how long recordings are kept, who inside the institution may view them, and what students are told before the exam.
How Examo answers the checklist
Examo is a remote proctoring application for Windows and macOS, built by LS2 Innovation in Montréal. Here is how it answers each line; the details are on the security and privacy page.
| Checklist line | Examo's answer |
|---|---|
| Collection | Video, audio, every connected screen, keyboard and mouse, each switchable per security profile or per exam. The event log and the SIS exam data cannot be switched off: they document and run the exam. |
| Hosting | Microsoft Azure's Canadian regions and the institution's own Microsoft 365 environment (Teams and SharePoint). |
| Subprocessors | Microsoft, as the hosting provider, is the only one. |
| Vendor access | Authorized teachers and administrators see recordings. LS2 staff, located in Canada, access data only for support, on request, with every access logged. |
| Retention | Set by the institution, up to seven years, with automatic deletion at expiry and deletion on request. |
| Biometrics and AI | None: no facial recognition, no automated behavior analysis, no suspicion score. The proctor confirms identity visually, and every incident goes to human review. |
| Reuse | Data belongs to the institution, serves only to provide the service, never trains AI models and is never shared with third parties. |
| Security | Encryption in transit (TLS) and at rest, role-based access, complete event and access logging. |
| Incidents | A confidentiality incident process that complies with Law 25, with notice to the institution without delay. |
| Documentation | On request: architecture and data flows, privacy policy, answers to your security questionnaire and support for your EFVP. |
Two points still need your own analysis. Under Law 25, Canadian hosting is not Quebec hosting, so ask which Azure region holds your data and record it in your EFVP. And because Examo collects no biometric data and makes no automated decision, your assessment can document that those features are absent rather than evaluate them.
Minimization happens in the exam settings: the three proctoring modes (live proctoring, continuous recording, automated detection of risk events) combine per exam, and any capture an exam does not need can stay off. Detections only flag events; a person decides what they mean.
Transparency is easier with a page students can read. The students page explains in plain language what is recorded, who sees it and when it is deleted; link it from your exam instructions alongside your own privacy notice.
LS2 Innovation has focused on cloud software for cégeps, colleges and universities since 2021, and its solutions are used by about fifty institutions. To show your privacy officer the capture settings, retention controls and documentation before the EFVP starts, book a demo.
Key takeaways
- Remote proctoring collects video, audio, screens and keyboard activity, so treat it as a privacy project and start the EFVP before the pilot.
- Enable only the captures each exam needs and set a retention period with automatic deletion, instead of recording everything and keeping it indefinitely.
- Ask vendors for written answers on hosting, subprocessors, staff access, biometrics, AI and model training, not for a compliance badge.
- Biometric identity checks and fully automated decisions add obligations under Quebec law, so know whether a tool uses them before you assess it.
- Confirm how each obligation applies to your institution with your privacy officer or legal counsel.
Bring your privacy officer to the demo
In 30 minutes, we walk through the data flows, the capture settings per exam, retention and deletion, and the documents your EFVP will need.
Book a demoFrequently asked questions
Does Law 25 apply to remote proctoring at a cégep or university?
Generally, yes. Cégeps and universities are generally covered by Quebec's public-sector act on access to documents and the protection of personal information, which Law 25 amended. A proctoring tool is an information system that handles personal information, some of it sensitive, so expect a privacy impact assessment, limits on collection and retention, incident procedures and clear information for students. Your privacy officer or legal counsel can confirm the details.
Is a privacy impact assessment required before buying proctoring software?
In general, a Quebec public body must assess the privacy factors of any project to acquire or develop an information system involving personal information, and must assess any communication of personal information outside Quebec. Remote proctoring fits that description. Start the EFVP while the requirements are being written, so its conclusions can shape the call for tenders and the exam settings rather than justify them afterwards.
Does facial recognition in proctoring require extra steps under Quebec law?
Generally, yes. Quebec law treats biometric information as sensitive, and verifying identity with biometric characteristics generally requires the person's express consent and a declaration to the Commission d'accès à l'information before the process is put in place. A tool where a proctor confirms identity visually from the camera feed avoids biometric processing altogether. Your privacy officer should confirm what applies to your use.
How long should proctoring recordings be kept?
Only as long as their purpose requires, then destroyed securely, in line with your institution's retention schedule. One way to set the period is to match the time during which a grade or an academic-integrity decision can still be reviewed or appealed. Look for a tool where the institution sets the period, deletion happens automatically at expiry and records can be deleted on request.
Where is Examo data hosted?
In Microsoft Azure's Canadian regions and in the institution's own Microsoft 365 environment, in Teams and SharePoint. Microsoft, as the hosting provider, is the only subprocessor. LS2 staff, located in Canada, access data only for support, on request, and every access is logged. Because Law 25 distinguishes Quebec from the rest of Canada, record the hosting region in your EFVP.