How Long Are Respondus Monitor Recordings Stored? (Retention Policy 2026)
The default retention
Per Respondus's privacy policy and standard institutional contracts:
- Default: 5 years after the term in which the exam was taken.
- Minimum (per Respondus contract template): 1 year (some institutions negotiate this).
- Maximum: No hard cap; some accreditation-driven institutions retain 7-10 years.
- Indefinite retention: Possible but rare; usually reserved for licensure exam recordings (NCLEX prep, bar review courses) where regulatory requirements dictate.
What's stored during the retention window
Everything Monitor captured plus the metadata layer:
- Webcam video (full duration of exam).
- Microphone audio (full duration).
- Periodic screen captures.
- Pre-exam ID photo + environment scan.
- Behavioral flags ("suspicious" timestamps).
- Session metadata (your name, student ID, exam, course, time).
Aggregate size per exam: ~100-300 MB depending on exam duration and video resolution.
How to find your institution's exact retention
- Email your university's registrar or privacy office. The retention is in your institution's data-handling policy or in their contract with Respondus.
- Check your university's student handbook (often has a "remote proctoring" section).
- Email privacy@respondus.com directly with your enrollment institution; they can confirm the contracted retention.
Your deletion rights
CCPA (California students)
The California Consumer Privacy Act gives you the right to request deletion of personal information. Respondus must respond within 45 days. Limitations: educational records may be exempt under FERPA.
GDPR (EU students)
The General Data Protection Regulation's "right to erasure" applies. Respondus must respond within 30 days. Same FERPA-exempt limitation applies for U.S. institutions teaching EU students.
FERPA (US students at federally-funded institutions)
The Family Educational Rights and Privacy Act gives you access to your educational records but does not include a deletion right while the records are active. After the retention period ends, FERPA-covered records are typically deleted.
Practical request procedure
- Email your university's privacy officer with your name, student ID, and the request: "I request deletion of all Respondus Monitor recordings associated with my account, citing [CCPA/GDPR right]."
- If your university escalates to Respondus, expect 30-45 days for response.
- If denied (likely under FERPA), the recordings stay for the retention window then auto-delete.
What happens after the retention period
Per Respondus's policy, recordings are auto-deleted from primary storage at the end of the retention period. Backups may persist for an additional 30-90 days depending on the backup rotation. Aggregated, anonymised statistical data (without identifying information) may be retained longer for service improvement.
If your university has a shorter retention
Some universities (notably Yale, several UC campuses, some EU universities subject to GDPR) have negotiated 1-2 year retention. Check your specific institution's policy. If yours has a default 5-year retention you're uncomfortable with, raising the issue with your registrar / dean of students is the path to renegotiation - happens occasionally with student advocacy.
Practical implications
- A webcam recording of your finals may exist for 5+ years after you graduate.
- Your face + voice are biometric data; jurisdictions like Illinois (BIPA) and Texas (CUBI) impose specific consent requirements.
- If Respondus is acquired or shuts down, your data's fate depends on the acquisition terms or wind-down plan.
- You will not be notified when your data is auto-deleted at the end of retention.
Frequently asked questions
Can I check what recordings of me Respondus has?
Yes, via right of access (CCPA / GDPR / FERPA). Email privacy@respondus.com with your name, dates of attendance, and institution. Response within 30-45 days.
Why does Respondus keep recordings for 5 years?
The retention covers university audit cycles and academic-integrity appeal windows. Universities sometimes need to revisit a graded exam years later; the recording is part of the record.
What if Respondus gets hacked during the retention period?
No public breach is documented. SOC 2 Type II compliance + encryption at rest + role-based access reduces the risk; it does not eliminate it. If a breach were to occur, Respondus is required by GDPR (for EU students) to notify within 72 hours and by various state laws to notify users in the U.S.