A Data Protection Design for Online Exam Proctoring in Compliance with the Indonesian Personal Data Protection Law

This paper proposes a personal data protection system for online exam proctoring that complies with Indonesian personal data protection laws. Ratified in 2022, the Government of Indonesia provides a grace period until 2024 in implementing this Law to prepare related parties to adapt their services to electronic and non-electronic based. Later violations of this Law can be subject to criminal penalties of 4–6 years, a maximum fine of 6 billion Rupiah per incident, and a maximum sanction of 2% of total annual income. This is a different motivation for related parties to ensure compliance with the PDP Law. Here we propose applying the data labeling model in combination with Fusion/UML to provide access control and guarantee privacy for access to personal data to comply with the PDP Law. We illustrate the design that we are proposing with a case study for Face Recognition-based remote proctoring in an online proctoring Learning Management System that runs at our institution.