Proctoring Online Assessments: How to Stop Cheating and Stay GDPR-Compliant
Ismayil Ismayilov8 min read
Remote assessments made hiring faster and more inclusive. They also made cheating easier. In 2026 the main threat isn't a friend in the room. It's an AI assistant generating answers in a second window. Employers need proctoring that actually works, and candidates are right to expect that their data and recordings are handled responsibly.
This article explains both sides. It is general information, not legal advice. Check the specifics with your data-protection officer or lawyer.
What modern proctoring looks like
| Control | What it catches |
|---|---|
| Randomised questions from a pool | Shared answers and leaked question lists |
| Time limits per test | Looking things up or consulting others |
| Full-screen enforcement | Switching to other apps or windows |
| Tab-switch and focus monitoring | Searching or using AI tools in another tab |
| Copy-paste detection | Pasting AI-generated or prepared answers |
| Screenshot-attempt detection | Capturing questions to share them |
| Screen + webcam recording | Everything above, reviewable by a person |
No single control is enough. Together they make cheating hard to do and easy to spot.
Why a recording beats a single "cheating score"
Automated flags are useful, but they are signals, not proof. A candidate can lose focus because a notification popped up. A full recording of the session lets a recruiter see what actually happened before making a decision. TheyTest records the whole assessment (screen and webcam, with the candidate's consent). Recruiters review flagged moments directly. The platform does not make automatic decisions about a candidate's identity.
The GDPR basics for proctored assessments
If you hire in the EU, or process data of people in the EU, the General Data Protection Regulation applies. Key points:
- Lawful basis. Most employers rely on legitimate interest or steps prior to a contract for assessment data. Document why proctoring is necessary for the role.
- Transparency. Tell candidates before the test what is monitored, whether it is recorded, who will see it, how long it is kept and why.
- Consent where required. Ask for explicit consent to camera and screen recording before the test starts, and make the alternative clear.
- Data minimisation. Monitor only what you need. Don't collect unrelated personal data.
- Retention limits. Delete recordings and results after a defined period (for example, 6–12 months) unless the candidate is hired or agrees to stay in your talent pool.
- No solely automated decisions with significant effects. Under Article 22, people have the right not to be subject to decisions based only on automated processing. Keep a human in the loop for rejections.
- Processor agreements. Your assessment vendor processes data on your behalf, so sign a Data Processing Agreement (DPA).
- Data location and security. Know where data is stored and how it is protected.
Biometrics: a line to be careful with
Automatic face recognition used to identify a person can count as biometric data, a special category under GDPR with stricter rules. Recording video for a person to review is different from running automated identity matching. Know which one your vendor does.
Beyond the EU
Many countries have their own data-protection laws: Türkiye's KVKK, Azerbaijan's Law on Personal Data, and the laws of Russia, Kazakhstan and Uzbekistan, among others. The principles are similar: inform candidates, collect only what you need, protect it and delete it on time. Check the local requirements for each country you hire in.
The EU AI Act and hiring
The EU AI Act classifies AI systems used for recruitment and selection as high-risk, with obligations around risk management, human oversight and transparency. If your assessment tool uses AI to score or flag candidates, ask the vendor how they meet these requirements and check the current application dates.
A candidate-friendly proctoring checklist
- Explain the rules and the recording on the invitation page.
- Let candidates check their camera and connection before starting.
- Avoid penalising one-off innocent events. Review the context.
- Offer reasonable alternatives or adjustments where needed.
- Give candidates a contact for privacy questions.
How TheyTest handles this
TheyTest is operated by an Estonian company, TheyCompany Tech OÜ, and is built for GDPR. Candidates are informed and consent before recording starts, assessment data is stored in the EU, and recruiters, not algorithms, make the final decision. Behaviour monitoring, randomisation, time limits and full session recording are included in every plan.
Start a free trial or contact us for our DPA.
FAQ
Is it legal to record candidates during an online test?
In most jurisdictions, yes, if candidates are clearly informed, the recording is necessary and proportionate, consent is collected where required, and the data is protected and deleted on time.
How long can we keep assessment recordings?
Only as long as needed for the hiring decision and any legal claims. Many employers choose 6–12 months. Define a period and stick to it.
Can proctoring detect ChatGPT and other AI tools?
No tool can see inside another app. But full-screen enforcement, tab-switch and copy-paste detection, time limits and a reviewable recording make AI-assisted answers very hard to hide.
