Information date: 16 October 2026 — On 5 June 2025, People's Daily reported that Vice Premier Ding Xuexiang, during an inspection in Shanxi, stressed guarding the 'lifeline' of fairness and justice and ensuring a safe and secure 2025 gaokao. Many exam sites use AI proctoring, facial recognition and video analytics to verify candidates and detect cheating. Vendors handling candidates' faces, ID numbers and exam behaviour data process sensitive personal information and must comply with China's Personal Information Protection Law and facial-recognition rules. Knowing that statement is not enough for an operating, research or compliance decision. The team must first establish who and what it applies to, how the effect reaches the real process, and which evidence would justify action.
Verified facts and scope
On 5 June 2025, People's Daily reported that Vice Premier Ding Xuexiang, during an inspection in Shanxi, stressed guarding the 'lifeline' of fairness and justice and ensuring a safe and secure 2025 gaokao. Many exam sites use AI proctoring, facial recognition and video analytics to verify candidates and detect cheating. Vendors handling candidates' faces, ID numbers and exam behaviour data process sensitive personal information and must comply with China's Personal Information Protection Law and facial-recognition rules.
Applies to technology vendors providing AI proctoring, facial recognition, identity verification or video analytics to exam authorities. Confirm whether the vendor is an entrusted processor, what data is collected, whether facial and ID data are sensitive personal information, how long data is retained, whether data is used to train models, whether any overseas access or transfer occurs, and what the education authority requires.
How the effect reaches operations
The gaokao is a high-stakes national exam, so authorities prioritise identity verification and anti-cheating. Vendors act as entrusted processors under a data-processing agreement; they may process data only for the agreed purpose and must implement encryption, access control and deletion. Facial recognition is sensitive personal information, requiring separate consent and a personal information protection impact assessment. Overseas access can trigger data-export rules.
Vendors may reuse candidate face data for algorithm training or product development, retain it beyond the exam cycle, fail to sign a data-processing agreement, allow overseas staff to access the system, or suffer a breach. Using AI proctoring without a lawful basis or separate consent can lead to fines, contract termination and reputational damage. Misjudging the vendor as a mere hardware supplier does not remove data duties.
For “News: AI Proctoring and Facial Recognition at China's 2025 Gaokao — Data-Handling Duties for Technology Vendors”, official rules or published findings, direct evidence from the relevant product or process, and assumptions that remain untested should be recorded separately. A broad source defines the external boundary; it does not replace batch records, protocols, contracts, labels or direct observations.
Decision
If the vendor only processes data on-site during the exam and deletes it immediately, risk is lower but still requires a processing agreement and security measures. If data is retained, used for model training or accessed from abroad, conduct a PIPIA, obtain separate consent and assess export rules before deployment. If export thresholds are met, file for security assessment or use standard contract/certification.
Implementation checklist
- Sign a data-processing agreement limiting purpose, retention and reuse.
- Complete a PIPIA and separate-consent mechanism for facial data.
- Store data locally and delete it on the exam authority's schedule.
- Assign one decision owner, one implementation owner and a dated review point for “News: AI Proctoring and Facial Recognition at China's 2025 Gaokao — Data-Handling Duties for Technology Vendors”.
- For “News: AI Proctoring and Facial Recognition at China's 2025 Gaokao — Data-Handling Duties for Technology Vendors”, archive the source page, access date, applicable population or entity, and internal evidence both supporting and opposing the current decision.
- When a rule, formulation, supplier, protocol or observed result changes, reopen only the affected question in “News: AI Proctoring and Facial Recognition at China's 2025 Gaokao — Data-Handling Duties for Technology Vendors”.
Evidence and review
For “News: AI Proctoring and Facial Recognition at China's 2025 Gaokao — Data-Handling Duties for Technology Vendors”, start with one real case rather than an abstract checklist. Record the input version, responsible owner, start time, observed result and stop condition. If the team cannot complete “Sign a data-processing agreement limiting purpose, retention and reuse.” with current evidence, it should not expand the process to more products, patients, suppliers or markets. The first review should focus only on facts capable of changing the decision.
The second control follows “Complete a PIPIA and separate-consent mechanism for facial data.”. Keep the source date, applicable population or entity, deadline, cost effect and owner in the same evidence file. A wording preference does not justify a new version. A repeated discrepancy, an unsupported health claim or a regulatory mismatch does: correct that point and hold release until the evidence is available.
After “Store data locally and delete it on the exam authority's schedule.”, compare the intended outcome with what actually happened. Apply the same success criteria to each later expansion. If only one number, date or responsibility changes, update that field and the affected conclusion instead of recreating evidence that remains valid. This keeps the decision traceable without turning review into an open-ended rewrite cycle.
Limits of the conclusion
This news analysis is not legal or data-protection advice; the CAC, education authorities and applicable standards determine compliance.
