# Transport Ministry seeks CERT-In audit of VAHAN, SARATHI portals after data sale reports

URL: https://upsc.help/current-affairs/2026-10-25/vahan-sarathi-data-sale-cert-in-audit/
Date: 25 October 2026 (2026-10-25)
Source: The Hindu, Page 12
UPSC papers: GS3, GS2
Publisher: upsc.help (Pratidin), free and open-source UPSC Civil Services current affairs. Not affiliated with UPSC. Every fact was checked against the source reports by a separate review before publishing.

**In one line:** After reports that vehicle owners' personal details were being sold for a few rupees, MoRTH asked CERT-In to audit four transport portals and asked app stores to pull the apps.

The Ministry of Road Transport and Highways (MoRTH) has asked CERT-In, the national cyber security agency, to carry out a forensic security audit of four of its portals: VAHAN (vehicle registration), SARATHI (driving licences), e-Challan (traffic fines) and PUCC (pollution under control certificates). The move, reported on 24 October 2026, follows reports that personal details drawn from these systems were being sold online through apps and messaging channels. The Ministry also asked app store operators, including Google, to remove apps that sell such data, sought the help of the Ministry of Electronics and Information Technology (MeitY) in reviewing data-sharing rules, and asked the National Informatics Centre (NIC) to examine whether entities using the logistics interface accessed records within their approved purpose.

The trigger was a series of findings by the Internet Freedom Foundation (IFF). In September 2026 it reported that a Play Store app with over 10 million downloads returned an owner's full name, father's name, addresses and insurance details from just a registration number, at about ₹1.93 a lookup, and cited a security firm's report of a Telegram service selling full records, including mobile numbers, licence, challan and FASTag details, for ₹5 a lookup. An RTI reply from NIC, published by IFF on 20 October, showed 25,314 credentials issued to private entities and about 1.708 crore queries through them between January 2024 and September 2026. NIC also said private information sharing was discontinued from 1 October 2026.

The data sits in the National Transport Repository, which IFF says holds records of over 39 crore vehicles and 22 crore driving licences. Selling access is not new: a 2019 Bulk Data Sharing Policy let firms buy a year's access for ₹3 crore before it was scrapped in 2020, and a 2025 policy allows private access to selected fields with consent safeguards. IFF argues that the Motor Vehicles Act provides for national registers but not for sharing with private firms, and that the Supreme Court's Puttaswamy judgment (2017) makes purpose limitation part of privacy. The Digital Personal Data Protection Act, 2023 requires reasonable security safeguards and breach notification, but its main duties apply only from 13 May 2027.

## Prelims facts

- MoRTH asked CERT-In for a forensic audit of the VAHAN, SARATHI, e-Challan and PUCC portals after reports of vehicle-owner data being sold online.
- An NIC RTI reply showed 25,314 credentials issued to private entities and about 1.708 crore queries from January 2024 to September 2026.
- A Telegram service reportedly sold full records for ₹5 a lookup; one Play Store app charged about ₹1.93 a lookup.
- CERT-In functions under Section 70B of the IT Act, 2000; its 2022 directions require cyber incidents to be reported within six hours.
- The DPDP Act, 2023 requires security safeguards and breach notification, with penalties up to ₹250 crore, but its main duties apply from 13 May 2027.

## Quick recall

- **Which four portals did MoRTH ask CERT-In to audit?** VAHAN, SARATHI, e-Challan and PUCC.
- **What does SARATHI hold?** Driving licence records.
- **Credentials issued to private entities, per NIC's RTI reply?** 25,314.
- **Queries through private credentials, January 2024 to September 2026?** About 1.708 crore (17,079,998).
- **Price per lookup reported for a Telegram service?** ₹5.
- **Under which provision of the IT Act does CERT-In function?** Section 70B of the Information Technology Act, 2000.
- **Maximum DPDP penalty for failing to keep reasonable security safeguards?** Up to ₹250 crore.
- **From when do the DPDP Act's main obligations apply?** 13 May 2027.

## Prelims practice question

With reference to India's transport e-governance systems, consider the following pairs:
1. VAHAN : Vehicle registration records
2. SARATHI : Driving licence records
3. PUCC : Toll payment through FASTag
How many of the pairs given above are correctly matched?

(a) Only one
(b) Only two
(c) All three
(d) None

Answer: (b) Only two. Pairs 1 and 2 are correct: VAHAN handles vehicle registration and SARATHI driving licences. Pair 3 is wrong: PUCC is the Pollution Under Control Certificate system; FASTag is the electronic toll system.

## UPSC previous-year questions this connects to

- UPSC Mains 2024, GS3: Describe the context and salient features of the Digital Personal Data Protection Act, 2023. (https://upsc.help/pyq/q216-describe-context-salient-features-digital-personal-data/)
  How to use this story in the answer: After listing the Act's features, use the VAHAN case to show why the Act's delayed start and its coverage of government bodies matter in practice.
- UPSC Mains 2022, GS3: What are the different elements of cyber security? Keeping in view the challenges in cyber security, examine the extent to which India has successfully developed a comprehensive National Cyber Security Strategy. (https://upsc.help/pyq/q343-different-elements-cyber-security-keeping-view-challenges/)
  How to use this story in the answer: Use it to show that cyber security includes access control and insider or partner misuse, not only defence against external attacks.
- UPSC Mains 2017, GS2: Examine the scope of Fundamental Rights in the light of the latest judgement of the Supreme Court on Right to Privacy. (https://upsc.help/pyq/q125-scope-fundamental-rights-light-latest-judgement-supreme/)

## Mains practice question

The reported sale of VAHAN and SARATHI data shows that the State itself can be a source of privacy risk. Examine the legal safeguards available and suggest reforms for government data-sharing. (250 words)

### Model answer

In October 2026 MoRTH sought a CERT-In forensic audit of VAHAN, SARATHI, e-Challan and PUCC after reports that owner data was sold online for as little as ₹5 a lookup.

## How the data escaped
- Records sit in the National Transport Repository (over 39 crore vehicles, 22 crore licences, per IFF).
- 25,314 credentials were issued to private entities, which ran about 1.708 crore queries in 33 months.
- Policy history: 2019 bulk sale (₹3 crore a year), scrapped in 2020; 2025 policy allows selected fields to private users.

## Safeguards available
- Puttaswamy (2017): privacy is a fundamental right; purpose limitation is part of it.
- IT Act, 2000: Section 70B (CERT-In); 2022 directions require incident reporting within six hours.
- DPDP Act, 2023: reasonable security safeguards, breach notification, penalty up to ₹250 crore.

## Gaps
- DPDP duties apply only from 13 May 2027.
- Data sharing rests on executive policy, not a specific statutory mandate, according to IFF.

## Reforms
- Statutory basis for sharing, limited to defined purposes.
- Field masking, query caps and logging, with periodic independent audits.
- Public list of data recipients; notify affected people after breaches.
- App store takedowns backed by penalties for resellers.

## Conclusion
The State holds the most complete citizen databases; treating it as a data fiduciary bound by purpose limitation is the test of India's privacy framework.

## The basics

## Why this matters
India runs some of the world's largest government databases. When their contents turn up for sale, the questions are about cyber security, privacy law and how the State shares what it collects. The VAHAN and SARATHI episode puts all three in one case.

## What these systems are
VAHAN holds vehicle registration records and SARATHI holds driving licence records. Together with e-Challan, FASTag and accident data, they feed the National Transport Repository run with the National Informatics Centre.

## How records reached the market
The leak was not a classic hack. IFF's reporting points to legitimate access being reused: credentials issued to private firms for verification, then resold through apps and channels. NIC's RTI reply showed 25,314 credentials issued to private entities and about 1.708 crore queries in 33 months.

## A long history of selling access

## The legal frame
The Right to privacy and purpose limitation comes from the Puttaswamy judgment of 2017. CERT-In is the agency for cyber incidents under the IT Act. The Digital Personal Data Protection Act, 2023 makes those who hold personal data, including government bodies, responsible for securing it. The National Transport Repository is where the data sits.

## Sources

- https://superkalam.com/current-affairs/25-10-2026/govt-orders-security-audit-of-key-transport-portals-after-reports-of-data-being-sold-online-pg12-8e06726b-ed64-4253-84e1-e7b2d6efbb2c
- https://www.newsbytesapp.com/news/india/indias-morth-probes-online-sale-of-vehicle-data-cert-in-audit/tldr
- https://anantamias.com/current-affairs/vehicle-data-audit-purpose-limited-access/
- https://internetfreedom.in/less-than-2-for-your-name-and-home-address-how-vahan-and-sarathi-data-is-being-sold-online/
- https://internetfreedom.in/who-reads-your-vehicle-record-nic-gave-us-numbers-morth-gave-us-a-generic-webpage/
- https://www.medianama.com/2025/08/223-morths-data-sharing-policy-access-personal-information/