Transport Ministry seeks CERT-In audit of VAHAN, SARATHI portals after data sale reports
In one line: After reports that vehicle owners' personal details were being sold for a few rupees, MoRTH asked CERT-In to audit four transport portals and asked app stores to pull the apps.
Published 25 October 2026. Written by Pratidin from the reports linked at the end; every fact checked by a separate review before publishing. How we work
The Ministry of Road Transport and Highways (MoRTH) has asked CERT-In, the national cyber security agency, to carry out a forensic security audit of four of its portals: VAHAN (vehicle registration), SARATHI (driving licences), e-Challan (traffic fines) and PUCC (pollution under control certificates). The move, reported on 24 October 2026, follows reports that personal details drawn from these systems were being sold online through apps and messaging channels. The Ministry also asked app store operators, including Google, to remove apps that sell such data, sought the help of the Ministry of Electronics and Information Technology (MeitY) in reviewing data-sharing rules, and asked the National Informatics Centre (NIC) to examine whether entities using the logistics interface accessed records within their approved purpose.
The trigger was a series of findings by the Internet Freedom Foundation (IFF). In September 2026 it reported that a Play Store app with over 10 million downloads returned an owner's full name, father's name, addresses and insurance details from just a registration number, at about ₹1.93 a lookup, and cited a security firm's report of a Telegram service selling full records, including mobile numbers, licence, challan and FASTag details, for ₹5 a lookup. An RTI reply from NIC, published by IFF on 20 October, showed 25,314 credentials issued to private entities and about 1.708 crore queries through them between January 2024 and September 2026. NIC also said private information sharing was discontinued from 1 October 2026.
The data sits in the National Transport Repository, which IFF says holds records of over 39 crore vehicles and 22 crore driving licences. Selling access is not new: a 2019 Bulk Data Sharing Policy let firms buy a year's access for ₹3 crore before it was scrapped in 2020, and a 2025 policy allows private access to selected fields with consent safeguards. IFF argues that the Motor Vehicles Act provides for national registers but not for sharing with private firms, and that the Supreme Court's Puttaswamy judgment (2017) makes purpose limitation part of privacy. The Digital Personal Data Protection Act, 2023 requires reasonable security safeguards and breach notification, but its main duties apply only from 13 May 2027.
Prelims facts
- MoRTH asked CERT-In for a forensic audit of the VAHAN, SARATHI, e-Challan and PUCC portals after reports of vehicle-owner data being sold online.
- An NIC RTI reply showed 25,314 credentials issued to private entities and about 1.708 crore queries from January 2024 to September 2026.
- A Telegram service reportedly sold full records for ₹5 a lookup; one Play Store app charged about ₹1.93 a lookup.
- CERT-In functions under Section 70B of the IT Act, 2000; its 2022 directions require cyber incidents to be reported within six hours.
- The DPDP Act, 2023 requires security safeguards and breach notification, with penalties up to ₹250 crore, but its main duties apply from 13 May 2027.
Quick recall
- Which four portals did MoRTH ask CERT-In to audit?
- VAHAN, SARATHI, e-Challan and PUCC.
- What does SARATHI hold?
- Driving licence records.
- Credentials issued to private entities, per NIC's RTI reply?
- 25,314.
- Queries through private credentials, January 2024 to September 2026?
- About 1.708 crore (17,079,998).
- Price per lookup reported for a Telegram service?
- ₹5.
- Under which provision of the IT Act does CERT-In function?
- Section 70B of the Information Technology Act, 2000.
- Maximum DPDP penalty for failing to keep reasonable security safeguards?
- Up to ₹250 crore.
- From when do the DPDP Act's main obligations apply?
- 13 May 2027.
Prelims practice question
With reference to India's transport e-governance systems, consider the following pairs:
1. VAHAN : Vehicle registration records
2. SARATHI : Driving licence records
3. PUCC : Toll payment through FASTag
How many of the pairs given above are correctly matched?
- Only one
- Only two
- All three
- None
Show answer
Answer: (b) Only two. Pairs 1 and 2 are correct: VAHAN handles vehicle registration and SARATHI driving licences. Pair 3 is wrong: PUCC is the Pollution Under Control Certificate system; FASTag is the electronic toll system.
Use this in UPSC Mains: previous-year questions
Recurring theme: Data protection, cyber security and the State as a holder of citizen data
Describe the context and salient features of the Digital Personal Data Protection Act, 2023.
How to use thisAfter listing the Act's features, use the VAHAN case to show why the Act's delayed start and its coverage of government bodies matter in practice.
- The Act requires reasonable security safeguards and breach notification; failure to keep safeguards can attract a penalty up to ₹250 crore.
- Main DPDP duties apply only from 13 May 2027, so the 2026 sale of VAHAN and SARATHI records falls largely outside it.
- NIC's RTI reply showed 25,314 private credentials and about 1.708 crore queries in 33 months.
- How to use this
Use it to show that cyber security includes access control and insider or partner misuse, not only defence against external attacks.
- MoRTH sought a CERT-In forensic audit of VAHAN, SARATHI, e-Challan and PUCC in October 2026.
- A security firm's report cited by IFF found full records sold on Telegram for ₹5 a lookup.
- CERT-In's 2022 directions require cyber incidents to be reported within six hours.
Purpose limitation, drawn from the Puttaswamy privacy judgment, is the test the resale of transport data fails.
Mains practice question
The reported sale of VAHAN and SARATHI data shows that the State itself can be a source of privacy risk. Examine the legal safeguards available and suggest reforms for government data-sharing. (250 words)
Model answer
In October 2026 MoRTH sought a CERT-In forensic audit of VAHAN, SARATHI, e-Challan and PUCC after reports that owner data was sold online for as little as ₹5 a lookup.
How the data escaped
- Records sit in the National Transport Repository (over 39 crore vehicles, 22 crore licences, per IFF).
- 25,314 credentials were issued to private entities, which ran about 1.708 crore queries in 33 months.
- Policy history: 2019 bulk sale (₹3 crore a year), scrapped in 2020; 2025 policy allows selected fields to private users.
Safeguards available
- Puttaswamy (2017): privacy is a fundamental right; purpose limitation is part of it.
- IT Act, 2000: Section 70B (CERT-In); 2022 directions require incident reporting within six hours.
- DPDP Act, 2023: reasonable security safeguards, breach notification, penalty up to ₹250 crore.
Gaps
- DPDP duties apply only from 13 May 2027.
- Data sharing rests on executive policy, not a specific statutory mandate, according to IFF.
Reforms
- Statutory basis for sharing, limited to defined purposes.
- Field masking, query caps and logging, with periodic independent audits.
- Public list of data recipients; notify affected people after breaches.
- App store takedowns backed by penalties for resellers.
Conclusion
The State holds the most complete citizen databases; treating it as a data fiduciary bound by purpose limitation is the test of India's privacy framework.
The basics
Why this matters
India runs some of the world's largest government databases. When their contents turn up for sale, the questions are about cyber security, privacy law and how the State shares what it collects. The VAHAN and SARATHI episode puts all three in one case.
What these systems are
VAHAN holds vehicle registration records and SARATHI holds driving licence records. Together with e-Challan, FASTag and accident data, they feed the National Transport Repository run with the National Informatics Centre.
- 1VAHANVehicle registration certificates and owner details
- 2SARATHIDriving licences
- 3e-ChallanTraffic fines and challan history
- 4PUCCPollution under control certificates
- 5FASTagElectronic toll records
How records reached the market
The leak was not a classic hack. IFF's reporting points to legitimate access being reused: credentials issued to private firms for verification, then resold through apps and channels. NIC's RTI reply showed 25,314 credentials issued to private entities and about 1.708 crore queries in 33 months.
A long history of selling access
- March 2019Bulk Data Sharing Policy: a year's access for ₹3 crore
- June 2020Policy scrapped over misuse risk
- August 2025New data sharing policy for the National Transport Repository
- September 2026IFF documents apps and a Telegram service selling records
- 1 October 2026NIC says private information sharing discontinued
- 24 October 2026MoRTH seeks CERT-In forensic audit of four portals
The legal frame
The Right to privacy and purpose limitation comes from the Puttaswamy judgment of 2017. CERT-In is the agency for cyber incidents under the IT Act. The Digital Personal Data Protection Act, 2023 makes those who hold personal data, including government bodies, responsible for securing it. The National Transport Repository is where the data sits.
- Fundamental right to privacy (2017)
- IT Act penalties and CERT-In incident reporting
- Contract terms in data-sharing policy
- DPDP duty to keep reasonable security safeguards
- Breach notice to the Board and affected people
- Penalty up to ₹250 crore for security failure
Go deeper
Why it matters for UPSC
It links GS3 cyber security, GS2 e-governance and privacy as a fundamental right. It is also a ready example for any question on the DPDP Act, or on the State as a holder of citizens' data.
The core idea
The National Transport Repository pools vehicle, licence, challan and toll data. Access given to private verification firms appears to have been resold. CERT-In now has to trace how. The Right to privacy and purpose limitation says data collected for registering a car should not end up on a resale app, and the Digital Personal Data Protection Act, 2023 will impose security and breach duties, but only from May 2027.
Numbers and dates to remember
- Four portals: VAHAN, SARATHI, e-Challan, PUCC
- 25,314 private credentials; about 1.708 crore queries, January 2024 to September 2026
- ₹5 a lookup on a Telegram service; about ₹1.93 on a Play Store app
- Repository: over 39 crore vehicles and 22 crore licences (IFF)
- DPDP penalty for security failure: up to ₹250 crore; main duties from 13 May 2027
Where to go next
- National Transport Repository: where the data sits and who can see it
- CERT-In: the agency now doing the forensic audit
- Right to privacy and purpose limitation: the constitutional test
- Digital Personal Data Protection Act, 2023: the law that will apply to such breaches
Go deeper: should the State sell or share citizen data at all?
The case for sharing. Banks, insurers and vehicle finance firms need to verify registrations and licences. Police need full records. The 2025 policy for the National Transport Repository tries to balance this by giving private users only selected fields, requiring consent through an Aadhaar-based OTP for personal data, and allowing bulk requests only through senior officials.
The case against loose sharing. IFF argues that the Motor Vehicles Act provides for national registers of vehicles and licences but does not authorise sharing with private firms, so the policy is an executive circular rather than law. Under the Right to privacy and purpose limitation, data collected to register a vehicle should not be reused for marketing or profiling. The 2019 bulk sale, scrapped in 2020, showed how easily datasets travel once sold.
What the audit can and cannot do. CERT-In can trace which credentials pulled which records and whether controls failed. NIC's own reply says API logs are kept for one year, which limits how far back the trail goes. An audit does not, by itself, compensate people whose data is already out.
The law's timing problem. The Digital Personal Data Protection Act, 2023 treats government bodies as data fiduciaries and requires breach notification, with penalties up to ₹250 crore. But its main duties begin on 13 May 2027. Until then, remedies rest on the IT Act and contract terms.
Reforms proposed. A statutory basis for sharing, a public register of recipients, field masking and query caps, independent audits, and notice to affected individuals.
National Transport Repository
Where India's vehicle and licence records are pooled
In one line: The National Transport Repository is MoRTH's central store that consolidates data from VAHAN, SARATHI, e-Challan, accident reports and FASTag.
What it holds
VAHAN covers vehicle registration and SARATHI covers driving licences. IFF reports that the repository holds records of over 39 crore vehicles and 22 crore driving licences. States issue the documents; the national system pools the records.
Who can see what
Under the 2025 data sharing policy, police and law enforcement get full access, States see records for their own territory, researchers get anonymised data, and private verification and service providers get selected fields. Personal data for banks or insurers needs the user's consent through an Aadhaar-based OTP.
Why it is in the news
Records drawn from these systems were reportedly sold through apps and a Telegram channel, prompting the October 2026 CERT-In audit.
Where to go next
CERT-In
India's cyber incident agency and its reporting rules
In one line: The Indian Computer Emergency Response Team is the national agency for responding to cyber security incidents.
Legal basis
CERT-In is designated under Section 70B of the Information Technology Act, 2000 and works under the Ministry of Electronics and Information Technology. It collects and analyses information on cyber incidents, issues alerts and advisories, and coordinates responses.
Reporting duties
Directions issued on 28 April 2022 require organisations to report cyber incidents, including data leaks, to CERT-In within six hours, and to keep logs for 180 days.
Why it is in the news
MoRTH asked CERT-In to carry out a forensic audit of the VAHAN, SARATHI, e-Challan and PUCC portals. IFF says a security firm had disclosed the Telegram resale service to CERT-In as early as 1 June 2026.
Where to go next
Right to privacy and purpose limitation
The constitutional test any government data-sharing must pass
In one line: Privacy is a fundamental right under Article 21, and using data only for the purpose it was collected for is part of that right.
The judgment
In Justice K.S. Puttaswamy v. Union of India (2017), a nine-judge Bench of the Supreme Court held that privacy is a fundamental right, intrinsic to life and personal liberty. Informational privacy, control over one's personal data, is part of it. Any intrusion must meet tests of legality, a legitimate aim and proportionality.
Purpose limitation
Purpose limitation means data gathered for one purpose, such as registering a vehicle, should not be used for unrelated ones, such as marketing. IFF also cites the 2018 Aadhaar judgment, which struck down private use of Aadhaar on contractual grounds.
Why it is in the news
Resale of VAHAN and SARATHI records is a clear breach of purpose limitation, whoever did it.
Where to go next
Digital Personal Data Protection Act, 2023
India's data protection law and why it does not yet bite
In one line: The DPDP Act, 2023 is India's general law on digital personal data, binding both private firms and government bodies that process it.
Key duties
A data fiduciary (anyone who decides why and how personal data is processed) must have a lawful purpose and consent or a legitimate use, take reasonable security safeguards to prevent breaches (Section 8(5)), inform the Data Protection Board and affected people of a breach (Section 8(6)), and erase data once its purpose is served (Section 8(7)). Failing to keep security safeguards can attract a penalty of up to ₹250 crore.
The timing gap
The DPDP Rules were notified in November 2025, but the main obligations begin on 13 May 2027. Until then, breaches like the VAHAN resale are handled under the IT Act.
Where to go next
Digital Personal Data Protection Act, 2023: every story that connects to it (3)
Take the 25 October 2026 quiz: 30 Prelims-style questions with answers