---
title: "Online Testing Platform Regulation"
url: "https://legal.ge/en/service/education-law-en/online-testing-platform-regulation-en"
field: "Education Law"
description: "Online testing platform regulation: video monitoring, biometrics, principles and complaints. Expert support on Legal.ge."
reviewed: "2026-07-09"
updated: "2026-11-08"
publisher: "legal.ge"
---

# Online Testing Platform Regulation

> Source: legal.ge, https://legal.ge/en/service/education-law-en/online-testing-platform-regulation-en

## Online Testing and Data Protection Requirements

Online testing platforms that rely on proctoring operate in one of the most sensitive areas of data protection law: a single examination session can involve identity data, video footage, screen content and often biometric data such as face or voice samples. Georgian legislation frames this relationship clearly: the provision on video monitoring expressly lists examination and testing purposes among the permitted aims, yet the permission is conditional — monitoring must be an adequate and proportionate means of achieving the processing purpose. The organiser and the platform are, as a rule, controllers: purpose, scope, security measures and rights-protection mechanisms are their statutory obligations.

## Principles of Data Processing in the Testing Context

The fundamental principles apply at every stage of an online examination. Data must be processed lawfully, fairly, transparently and without violating the subject's dignity; collection is allowed only for specific, clearly defined and legitimate purposes, and incompatible further processing is prohibited. Processing must be limited to what is necessary and proportionate to the aim — directly limiting how much material a proctoring system may capture, store and analyse.

Accuracy requires that data be genuine and precise, and that inaccurate data be corrected, erased or destroyed without unjustified delay; fact-based data must be distinguished from personal assessments. Once the purpose has been achieved, recordings and identification data must be deleted, destroyed or depersonalised, unless storage is prescribed by law or a subordinate normative act adopted on its basis. The security obligation adds technical and organisational measures against unauthorised or unlawful processing, accidental loss and damage.

Where data collected during a test is later processed for a different purpose without consent or a statutory basis, the controller must weigh the connection between the purposes, the relationship with the data subject, the subject's reasonable expectations, the involvement of special categories of data, the consequences and the security measures — and must be able to demonstrate compliance.

## Biometric Data in Proctoring

Facial recognition and voice analysis, on which many platforms' verification modules rely, constitute processing of biometric data, regulated strictly. Biometric data may be processed only where necessary for carrying out an activity, security, protection of property and prevention of the disclosure of secret information, and where those purposes cannot be achieved by other means or only with disproportionately great effort. For a private examination organiser the decisive test remains necessity and the absence of a less intrusive alternative.

The procedural requirement is equally explicit: before processing, the controller must define in writing the purpose and scope of biometric processing, the storage period, the storage and destruction rules, and the rights-protection mechanisms. In practice, this document must exist before the examination and be comprehensible to candidates.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/education-law-en/online-testing-platform-regulation-en

### Is video monitoring of online exams permitted?

Yes, examination and testing purposes are expressly listed among the permitted aims of video monitoring, provided it is an adequate and proportionate means of achieving the purpose.

### What obligations does a platform have regarding biometric data?

Processing is allowed only where necessary and where no less intrusive alternative exists; before processing, the purpose, scope, storage period, destruction rules and rights-protection mechanisms must be defined in writing.

### Where is video monitoring prohibited?

In changing rooms, hygiene areas and any space where the person has a reasonable expectation of privacy.

### To whom should a candidate complain about a violation?

To the State Audit Service, the court or a superior administrative body; blocking of the data may also be requested before the completion of consideration.