# Film certification records of over 500 titles exposed in CBFC data leak

URL: https://upsc.help/current-affairs/2026-10-25/cbfc-ecinepramaan-records-leak/
Date: 25 October 2026 (2026-10-25)
Source: The Hindu, Page 1
UPSC papers: GS2, GS3
Publisher: upsc.help (Pratidin), free and open-source UPSC Civil Services current affairs. Not affiliated with UPSC. Every fact was checked against the source reports by a separate review before publishing.

**In one line:** Scripts, censor cut lists and distribution deals for over 500 films, filed on the CBFC's e-Cinepramaan portal, were exposed on a public archive, and the Board has ordered a security audit.

Documents linked to more than 500 film titles submitted to the Central Board of Film Certification (CBFC) through its e-Cinepramaan portal were found openly available on the Internet Archive, The Hindu reported on 25 October 2026. The records cover applications from December 2025 to August 2026. They include shooting scripts, some with shot descriptions and dialogue notes, details of cuts and changes ordered by the CBFC, and local distribution agreements showing what distributors paid for release rights. The films themselves were not leaked. The files stayed online until they were taken down on 12 October 2026.

The uploader used the name of former CBFC chairman Prasoon Joshi, written in Russian, as a username; the account has since been deleted and could not be contacted. How the files were obtained is still unclear. The office of CBFC Chairperson Shashi Shekhar Vempati said its checks had so far found no trace of the certification documents said to have been accessed, and a technical team found no sign of unauthorised access to individual filmmakers' accounts. The Board filed a complaint with cybercrime authorities, informed CERT-In, the national cyber incident agency, and committed to a thorough security audit of e-Cinepramaan, the online portal launched in 2017 through which filmmakers apply for certification.

The CBFC is a statutory body under the Ministry of Information and Broadcasting, set up under the Cinematograph Act, 1952; no film can be shown publicly in a cinema without its certificate. The leak matters beyond the film trade. Distribution prices are usually kept private between companies. Much of this is business data rather than personal data, so the Digital Personal Data Protection Act, 2023, which protects information about identifiable individuals, may not cover most of it.

## Prelims facts

- Documents of over 500 film titles from the CBFC's e-Cinepramaan portal, covering December 2025 to August 2026, were exposed on the Internet Archive until 12 October 2026.
- Leaked material included shooting scripts, CBFC cut orders and distribution agreements with licensing fees; the films themselves were not leaked.
- The CBFC filed a cybercrime complaint, informed CERT-In and promised a security audit of e-Cinepramaan, launched in 2017.
- The CBFC is a statutory body under the Cinematograph Act, 1952 and the Ministry of Information and Broadcasting.
- The Cinematograph (Amendment) Act, 2023 made certificates perpetual and split UA into UA 7+, UA 13+ and UA 16+.

## Quick recall

- **How many film titles were linked to the CBFC leak?** More than 500.
- **Period covered by the leaked records?** December 2025 to August 2026.
- **Where were the documents found, and when were they taken down?** On the Internet Archive; taken down on 12 October 2026.
- **Name of the CBFC's online certification portal and its launch year?** e-Cinepramaan, launched in 2017.
- **Under which law is the CBFC constituted?** The Cinematograph Act, 1952.
- **Validity of a CBFC certificate after the 2023 amendment?** Perpetual, replacing the earlier ten-year validity.
- **Penalty for film piracy under the 2023 amendment?** Imprisonment of 3 months to 3 years and a fine from ₹3 lakh up to 5% of the audited gross production cost.
- **Which agencies did the CBFC approach after the leak?** Cybercrime authorities (complaint) and CERT-In (informed).

## Prelims practice question

With reference to film certification in India, consider the following statements:
1. The Central Board of Film Certification is a statutory body under the Ministry of Information and Broadcasting.
2. After the 2023 amendment, CBFC certificates are valid for ten years.
3. The UA category has been divided into UA 7+, UA 13+ and UA 16+.
Which of the statements given above are correct?

(a) 1 and 2 only
(b) 2 and 3 only
(c) 1 and 3 only
(d) 1, 2 and 3

Answer: (c) 1 and 3 only. Statement 1 is correct: the CBFC is set up under the Cinematograph Act, 1952 and works under the Ministry of Information and Broadcasting. Statement 2 is wrong: the Cinematograph (Amendment) Act, 2023 replaced the ten-year validity with perpetual validity. Statement 3 is correct: the 2023 amendment introduced UA 7+, UA 13+ and UA 16+.

## UPSC previous-year questions this connects to

- UPSC Mains 2022, GS3: What are the different elements of cyber security? Keeping in view the challenges in cyber security, examine the extent to which India has successfully developed a comprehensive National Cyber Security Strategy. (https://upsc.help/pyq/q343-different-elements-cyber-security-keeping-view-challenges/)
  How to use this story in the answer: Cite the CBFC leak to show that cyber security challenges include protecting confidential filings on government portals, not just defending critical infrastructure.
- UPSC Mains 2024, GS3: Describe the context and salient features of the Digital Personal Data Protection Act, 2023. (https://upsc.help/pyq/q216-describe-context-salient-features-digital-personal-data/)
  How to use this story in the answer: Note a limit of the Act: it covers personal data of individuals, so leaks of commercial material like scripts and licensing fees fall largely outside it.
- UPSC Mains 2014, GS2: What do you understand by the concept "freedom of speech and expression"? Does it cover hate speech also? Why do the films in India stand on a slightly different plane from other forms of expression? Discuss. (https://upsc.help/pyq/q036-do-you-understand-concept-freedom-speech-expression/)

## Mains practice question

The CBFC data leak shows that government portals collecting confidential business information face risks that personal data law does not fully address. Discuss. (150 words)

### Model answer

In October 2026 documents of over 500 film titles from the CBFC's e-Cinepramaan portal were found on the Internet Archive, including scripts, cut orders and distribution prices.

## Why the risk is distinct
- Most leaked material is commercial: scripts and licensing fees, which companies usually keep private.
- Applicants had no choice: certification under the Cinematograph Act, 1952 is mandatory for public exhibition.

## Gaps in the law
- The DPDP Act, 2023 protects personal data of identifiable individuals, not business confidential information.

## Way forward
- Security audits and access logs for every portal that collects confidential filings.
- Classify and encrypt commercially sensitive submissions; limit retention.
- Notify affected applicants promptly and fix accountability for lapses.

When the State compels disclosure, it owes a matching duty of care.

## The basics

## Why this matters
Before a film reaches a cinema in India, its makers must hand the State a great deal of confidential material. The CBFC leak shows what happens when that material escapes, and it raises a question the data protection law does not fully answer: who protects business secrets that citizens are forced to file?

## What the CBFC is
The Central Board of Film Certification is a statutory body under the Cinematograph Act, 1952, working under the Ministry of Information and Broadcasting through regional offices. A film cannot be exhibited publicly without its certificate.

## How the filing works
Since 2017 applicants use e-Cinepramaan, the online portal for certification. They upload the film, scripts and supporting documents, receive the Board's decisions, including any cuts, and track progress.

## What leaked and what did not

## The law around it
The Cinematograph (Amendment) Act, 2023, covered under Cinematograph Act, 1952, tightened anti-piracy rules and made certificates perpetual. Cyber incidents go to CERT-In. But the DPDP Act, 2023 protects personal data, not trade secrets, so commercial material like licensing fees and scripts sits largely outside it. That gap is why the security of government portals that compel confidential filings is now a governance issue in its own right.

## Sources

- https://superkalam.com/current-affairs/25-10-2026/film-certification-records-exposed-in-cbfc-data-leak-pg1-8ae58976-96e7-43c3-89f1-22bb1e638226
- https://theprint.in/entertainment/cbfc-data-breach-scripts-censor-cuts-film-distribution/3081894/
- https://www.ensureias.com/?p=20160
- https://compass.rauias.com/current-affairs/cinematograph-amendment-bill-2023/