How to GDPR-Delete Your Respondus Monitor Recording (EU Students, 2026)
GDPR Article 17 ("right to erasure") gives EU students the legal right to have their Respondus Monitor recording deleted from both Respondus and their university's data controllers. Both controllers must respond within 30 days. Below: who to email, what to include, what they're likely to say back, and what to do if denied.
Who is the data controller for your recording?
Under GDPR, your university is the primary data controller - they decided to deploy LDB and define the retention policy. Respondus is a data processor acting on your university's instructions. This matters for who you email and in what order.
| Entity | Role | Where to write |
|---|---|---|
| Your university | Data Controller | Their Data Protection Officer (DPO) - usually dpo@[your-university].edu |
| Respondus | Data Processor | privacy@respondus.com |
The deletion request - exact wording
Send the same email to BOTH addresses. Sample template:
Subject: GDPR Article 17 Erasure Request - [Your Full Name], Student ID [#]
Dear Data Protection Officer,
Under Article 17 of the GDPR, I am exercising my right to erasure for the
following personal data processed in connection with my enrollment:
- Respondus Monitor exam recordings (video, audio, screenshots, ID photo)
- LockDown Browser session logs
- Any associated metadata (IP address, device fingerprint, timestamps)
Specifically: all recordings from exams I sat between [start date] and
[end date] for course(s) [course code(s)].
Legal basis for the request: I no longer require these recordings for the
purpose for which they were collected (Art. 17(1)(a)), and I withdraw any
prior consent to their processing (Art. 17(1)(b)).
I request:
1. Confirmation of erasure within 30 days per Art. 12(3).
2. Notification to Respondus (the processor) under Art. 19.
3. Confirmation of which third parties (if any) received the data and
the steps taken to inform them of the erasure.
If you intend to refuse this request, please cite the specific exemption
under Art. 17(3).
Thank you,
[Your name]
[University email]
[Student ID]
[Date]
What they'll likely say back
| Likely response | What it means | Your move |
|---|---|---|
| "Granted - deleted within 30 days, confirmation forthcoming" | Standard outcome for older recordings outside legal-hold periods. | Save the email confirmation. |
| "Refused under Art. 17(3)(e) - establishment, exercise or defence of legal claims" | If there's any pending academic-integrity flag, retention is mandated. | Resolve the underlying academic-integrity issue first, then re-request. |
| "Refused - required for compliance with legal obligation (Art. 17(3)(b))" | Some institutions cite accreditation or audit requirements. | Ask which specific law/regulation. Often this is overstated; escalate to your national DPA if unsupported. |
| No response after 30 days | GDPR violation. | Complain to your national Data Protection Authority. List of DPAs: edpb.europa.eu. |
If denied: escalation path
- Request a written explanation citing the specific Art. 17(3) exemption invoked.
- If you disagree, file a complaint with your country's Data Protection Authority (free, no lawyer needed). Most DPAs have an online complaint form.
- The DPA can compel the controller to delete or to justify retention. Median resolution time: 4-8 months.
Practical timing tips
- Wait at least 30 days after the exam window closes - controllers often refuse requests during active grading periods, citing "necessity for the original purpose".
- Send from your university email, not personal - proves identity without further authentication.
- Include your student ID - speeds up internal lookup.
- Keep a copy of every reply - evidence if you need to escalate to the DPA.
Frequently asked questions
Do I need a lawyer to file a GDPR deletion request?
No. The right is self-executing - controllers must respond regardless of whether you have legal representation. National DPAs accept complaints from individuals directly with no lawyer required.
Will requesting deletion affect my grades?
It cannot legally - universities cannot retaliate against students exercising data-protection rights (Art. 12 + national academic regulations). If you experience grade retaliation, document it and add it to your DPA complaint.
I'm a non-EU student studying at an EU university. Does GDPR apply to me?
Yes. GDPR applies to data processing within the EU regardless of the data subject's nationality. If your university is in the EU, your recording is covered.