Film certification records of over 500 titles exposed in CBFC data leak
In one line: Scripts, censor cut lists and distribution deals for over 500 films, filed on the CBFC's e-Cinepramaan portal, were exposed on a public archive, and the Board has ordered a security audit.
Published 25 October 2026. Written by Pratidin from the reports linked at the end; every fact checked by a separate review before publishing. How we work
Documents linked to more than 500 film titles submitted to the Central Board of Film Certification (CBFC) through its e-Cinepramaan portal were found openly available on the Internet Archive, The Hindu reported on 25 October 2026. The records cover applications from December 2025 to August 2026. They include shooting scripts, some with shot descriptions and dialogue notes, details of cuts and changes ordered by the CBFC, and local distribution agreements showing what distributors paid for release rights. The films themselves were not leaked. The files stayed online until they were taken down on 12 October 2026.
The uploader used the name of former CBFC chairman Prasoon Joshi, written in Russian, as a username; the account has since been deleted and could not be contacted. How the files were obtained is still unclear. The office of CBFC Chairperson Shashi Shekhar Vempati said its checks had so far found no trace of the certification documents said to have been accessed, and a technical team found no sign of unauthorised access to individual filmmakers' accounts. The Board filed a complaint with cybercrime authorities, informed CERT-In, the national cyber incident agency, and committed to a thorough security audit of e-Cinepramaan, the online portal launched in 2017 through which filmmakers apply for certification.
The CBFC is a statutory body under the Ministry of Information and Broadcasting, set up under the Cinematograph Act, 1952; no film can be shown publicly in a cinema without its certificate. The leak matters beyond the film trade. Distribution prices are usually kept private between companies. Much of this is business data rather than personal data, so the Digital Personal Data Protection Act, 2023, which protects information about identifiable individuals, may not cover most of it.
Prelims facts
- Documents of over 500 film titles from the CBFC's e-Cinepramaan portal, covering December 2025 to August 2026, were exposed on the Internet Archive until 12 October 2026.
- Leaked material included shooting scripts, CBFC cut orders and distribution agreements with licensing fees; the films themselves were not leaked.
- The CBFC filed a cybercrime complaint, informed CERT-In and promised a security audit of e-Cinepramaan, launched in 2017.
- The CBFC is a statutory body under the Cinematograph Act, 1952 and the Ministry of Information and Broadcasting.
- The Cinematograph (Amendment) Act, 2023 made certificates perpetual and split UA into UA 7+, UA 13+ and UA 16+.
Quick recall
- How many film titles were linked to the CBFC leak?
- More than 500.
- Period covered by the leaked records?
- December 2025 to August 2026.
- Where were the documents found, and when were they taken down?
- On the Internet Archive; taken down on 12 October 2026.
- Name of the CBFC's online certification portal and its launch year?
- e-Cinepramaan, launched in 2017.
- Under which law is the CBFC constituted?
- The Cinematograph Act, 1952.
- Validity of a CBFC certificate after the 2023 amendment?
- Perpetual, replacing the earlier ten-year validity.
- Penalty for film piracy under the 2023 amendment?
- Imprisonment of 3 months to 3 years and a fine from ₹3 lakh up to 5% of the audited gross production cost.
- Which agencies did the CBFC approach after the leak?
- Cybercrime authorities (complaint) and CERT-In (informed).
Prelims practice question
With reference to film certification in India, consider the following statements:
1. The Central Board of Film Certification is a statutory body under the Ministry of Information and Broadcasting.
2. After the 2023 amendment, CBFC certificates are valid for ten years.
3. The UA category has been divided into UA 7+, UA 13+ and UA 16+.
Which of the statements given above are correct?
- 1 and 2 only
- 2 and 3 only
- 1 and 3 only
- 1, 2 and 3
Show answer
Answer: (c) 1 and 3 only. Statement 1 is correct: the CBFC is set up under the Cinematograph Act, 1952 and works under the Ministry of Information and Broadcasting. Statement 2 is wrong: the Cinematograph (Amendment) Act, 2023 replaced the ten-year validity with perpetual validity. Statement 3 is correct: the 2023 amendment introduced UA 7+, UA 13+ and UA 16+.
Use this in UPSC Mains: previous-year questions
Recurring theme: Cyber security of government systems, statutory bodies and the special position of films
- How to use this
Cite the CBFC leak to show that cyber security challenges include protecting confidential filings on government portals, not just defending critical infrastructure.
- Documents of over 500 films from the CBFC's e-Cinepramaan portal, including scripts and licensing fees, were exposed on the Internet Archive until 12 October 2026.
- The CBFC informed CERT-In, filed a cybercrime complaint and promised a security audit of the portal.
Describe the context and salient features of the Digital Personal Data Protection Act, 2023.
How to use thisNote a limit of the Act: it covers personal data of individuals, so leaks of commercial material like scripts and licensing fees fall largely outside it.
- The 2026 CBFC leak exposed scripts, cut orders and distribution prices for over 500 films, mostly business rather than personal data.
- This points to a need for security duties on government portals that compel confidential filings.
Films stand on a different plane because they are pre-certified by the CBFC; the security of that process is part of its legitimacy.
Mains practice question
The CBFC data leak shows that government portals collecting confidential business information face risks that personal data law does not fully address. Discuss. (150 words)
Model answer
In October 2026 documents of over 500 film titles from the CBFC's e-Cinepramaan portal were found on the Internet Archive, including scripts, cut orders and distribution prices.
Why the risk is distinct
- Most leaked material is commercial: scripts and licensing fees, which companies usually keep private.
- Applicants had no choice: certification under the Cinematograph Act, 1952 is mandatory for public exhibition.
Gaps in the law
- The DPDP Act, 2023 protects personal data of identifiable individuals, not business confidential information.
Way forward
- Security audits and access logs for every portal that collects confidential filings.
- Classify and encrypt commercially sensitive submissions; limit retention.
- Notify affected applicants promptly and fix accountability for lapses.
When the State compels disclosure, it owes a matching duty of care.
The basics
Why this matters
Before a film reaches a cinema in India, its makers must hand the State a great deal of confidential material. The CBFC leak shows what happens when that material escapes, and it raises a question the data protection law does not fully answer: who protects business secrets that citizens are forced to file?
What the CBFC is
The Central Board of Film Certification is a statutory body under the Cinematograph Act, 1952, working under the Ministry of Information and Broadcasting through regional offices. A film cannot be exhibited publicly without its certificate.
- 1UUnrestricted public exhibition
- 2UA 7+, UA 13+, UA 16+Open to all, with parental guidance for children below the age shown
- 3AAdults only
- 4SSpecialised audiences such as doctors or scientists
How the filing works
Since 2017 applicants use e-Cinepramaan, the online portal for certification. They upload the film, scripts and supporting documents, receive the Board's decisions, including any cuts, and track progress.
- 1ApplyProducer files on e-Cinepramaan with scripts and documents
- 2ExamineAn examining committee views the film
- 3DecideBoard orders cuts or changes, if any, and assigns a category
- 4CertifyCertificate issued; under the 2023 amendment it is valid in perpetuity
What leaked and what did not
- Shooting scripts with shot and dialogue notes
- Cuts and changes ordered by the CBFC
- Distribution agreements with licensing fees
- The films themselves
- Any confirmed breach of filmmakers' accounts, per CBFC's initial checks
The law around it
The Cinematograph (Amendment) Act, 2023, covered under Cinematograph Act, 1952, tightened anti-piracy rules and made certificates perpetual. Cyber incidents go to CERT-In. But the DPDP Act, 2023 protects personal data, not trade secrets, so commercial material like licensing fees and scripts sits largely outside it. That gap is why the security of government portals that compel confidential filings is now a governance issue in its own right.
Go deeper
Why it matters for UPSC
It touches GS2 (statutory bodies, e-governance, freedom of expression in films) and GS3 (cyber security). It also shows a gap in India's data framework: protection of confidential business data that citizens must file with the State.
The core idea
The Central Board of Film Certification decides whether and how a film can be shown, under the Cinematograph Act, 1952. To get a certificate, producers file confidential material on e-Cinepramaan. That material leaked. The Board has turned to CERT-In and cybercrime authorities. Because most of what leaked is commercial rather than personal, the DPDP Act may offer little remedy.
Numbers and dates to remember
- More than 500 film titles; records from December 2025 to August 2026
- Files taken down from the Internet Archive on 12 October 2026
- e-Cinepramaan launched in 2017
- Cinematograph Act: 1952; amendment: 2023 (perpetual certificates; UA 7+, 13+, 16+)
- Piracy penalty: 3 months to 3 years' jail; fine ₹3 lakh up to 5% of audited gross production cost
Where to go next
- Central Board of Film Certification: what the Board is and how it certifies
- Cinematograph Act, 1952: the law, and its 2023 amendment
- e-Cinepramaan: the portal that leaked
- CERT-In: the agency handling cyber incidents
Go deeper: when the State compels disclosure, what does it owe?
A compelled filing. Under the Cinematograph Act, 1952, a film cannot be shown publicly without a certificate. Producers therefore have no choice but to hand over scripts and deal documents through e-Cinepramaan. That compulsion arguably creates a strong duty of care on the State.
What the CBFC says. The Central Board of Film Certification says its checks so far found no trace of the documents said to have been accessed and no sign of unauthorised access to filmmakers' accounts. It has filed a cybercrime complaint, informed CERT-In and promised a thorough audit. The uploader's identity, which used former chairman Prasoon Joshi's name in Russian, remains unknown.
Who is hurt. Licensing fees are usually kept private between companies, and knowing past terms could help rivals negotiate. The 2023 amendment introduced piracy penalties of up to three years in jail, but penalties do not undo a leak.
The legal gap. The DPDP Act, 2023 protects personal data of individuals. Trade secrets and confidential business information have no single statute in India; protection rests mainly on contract and general law. Government portals therefore need their own security standards, audits and breach notification for confidential filings.
The free speech angle. Films stand on a slightly different footing from other speech because they are pre-certified. That system's legitimacy depends partly on trust that what filmmakers submit is safe.
Bottom line. A security audit is the first step; clear duties for portals that hold compelled business data would be the lasting fix.
Central Board of Film Certification
The statutory body that decides how films can be shown
In one line: The CBFC is the statutory body that certifies films for public exhibition in India.
What it is
The CBFC is set up under the Cinematograph Act, 1952 and works under the Ministry of Information and Broadcasting, through regional offices. It examines films and decides whether to certify them, in which category, and whether cuts or changes are needed.
Categories
U (unrestricted), UA with sub-categories UA 7+, UA 13+ and UA 16+ (open to all, with parental guidance below the stated age), A (adults only), and S (specialised audiences such as doctors or scientists).
Why it is in the news
Records of over 500 film applications filed with the CBFC were exposed online in October 2026. Its Chairperson's office says it has started an investigation and a security audit.
Where to go next
Central Board of Film Certification: every story that connects to it (2)
Cinematograph Act, 1952
The law behind film certification and its 2023 overhaul
In one line: The Cinematograph Act, 1952 is the law that provides for certification of films for public exhibition and sets up the CBFC.
The 2023 amendment
The Cinematograph (Amendment) Act, 2023 made several changes:
- Certificates became valid in perpetuity, replacing the ten-year validity.
- The UA category was split into UA 7+, UA 13+ and UA 16+.
- Unauthorised recording and exhibition (piracy) became punishable with 3 months to 3 years' imprisonment and a fine of ₹3 lakh up to 5% of the audited gross production cost.
- The CBFC can issue a separate certificate for television and other media.
Revisional power
The Union government has no revisional power over certified films, consistent with the K.M. Shankarappa case, where courts held the government could not revise the Board's decisions.
Where to go next
e-Cinepramaan
The online portal whose records leaked
In one line: e-Cinepramaan is the CBFC's online certification system, launched in 2017, through which filmmakers apply for certificates.
What it does
Applicants file their applications, upload scripts and documents, receive the Board's decisions, including cuts or changes, and track progress online. It moved certification filing online.
What leaked
Documents linked to over 500 titles, covering December 2025 to August 2026, were found on the Internet Archive and taken down on 12 October 2026. They included shooting scripts, cut orders and distribution agreements with licensing fees. The films themselves were not leaked.
What next
The CBFC has promised a thorough security audit of the portal.
Where to go next
CERT-In
The national agency that handles cyber incidents like this one
In one line: CERT-In, the Indian Computer Emergency Response Team, is the national agency for responding to cyber security incidents.
Legal basis and role
CERT-In is designated under Section 70B of the Information Technology Act, 2000 and works under the Ministry of Electronics and Information Technology. It collects and analyses information on cyber incidents, issues alerts and coordinates responses.
Reporting rule
Its directions of April 2022 require organisations to report cyber incidents, including data leaks, within six hours.
Why it is in the news
The CBFC informed CERT-In about the e-Cinepramaan leak. In the same week, the Transport Ministry asked CERT-In to audit its VAHAN and SARATHI portals after reports of data being sold.
Where to go next
Take the 25 October 2026 quiz: 30 Prelims-style questions with answers