DPDP Act State Exemptions and the VAHAN Leak: Privacy Risks in Sovereign Databases

Context

India's sovereign digital architecture faces intense scrutiny. Regular leaks from state repositories expose the personal data of millions to online exploitation.

Mandated registries like the National Transport Repository hold identity markers under sovereign custody. Yet statutory protections under privacy legislation systematically favour the state.

State exemptions under Section 17 of the Digital Personal Data Protection Act, 2023 undermine citizen privacy. They institutionalise sovereign immunity across mandatory public databases without establishing reciprocal legal accountability.

Resolving this structural flaw requires testing sovereign administrative practices directly against fundamental constitutional rights.

The Ministry of Road Transport and Highways faced fresh scrutiny after reports surfaced detailing the illicit sale of citizen vehicle and licence records online. As of October 2026, MoRTH ordered CERT-In to conduct a cybersecurity forensic audit across VAHAN, SARATHI, e-Challan, and PUCC portals, per a report by The Hindu (as reported on 24 October 2026).

The inquiry followed formal representations showing that citizen vehicle records were selling online for ₹5 to ₹29 via third-party mobile apps and messaging channels.

The National Transport Repository centralises vast troves of personal information on National Informatics Centre infrastructure. According to the MoRTH Policy for Data Sharing from National Transport Repository, this database consolidates records of over 390 million vehicles and 220 million driving licences across VAHAN, SARATHI, e-Challan, eDAR, and FASTag systems.

The compromised parameters spanned three distinct categories of personally identifiable information:

• Vehicle registration numbers, engine numbers, and chassis details
• Registered owner names and residential addresses
• Linked contact credentials and mobile phone numbers

This exposure revealed how administrative registries convert into surveillance vulnerabilities when perimeter controls fail. The core problem is not just technical weakness; it is a statutory framework that frees public authorities from mandatory transparency.

The National Informatics Centre operates transport systems as a connected digital pipeline. VAHAN handles motor vehicle registration for state transport departments. SARATHI manages driving licences, driving school accreditations, and learner permits. Parallel platforms like e-Challan and FASTag feed real-time telemetry straight into the primary database.

Centralisation improves operational speed, but it creates high-value targets for data scraping. Consolidating departmental silos means a single leaked credential or exposed Application Programming Interface (API) compromises the entire supply chain. Peripheral endpoints turn into backdoors when unvetted external services gain query access.

State transport data has a history of commercial monetisation. Under the scrapped Bulk Data Sharing Policy of 2019, the Central Government sold bulk database access to 87 private and 32 government entities. That commercial scheme earned approximately ₹111 crore before public authorities cancelled the policy in June 2020 amid privacy objections.

Administrative rules tried to tighten technical controls after that cancellation. Under the Policy for Data Sharing from National Transport Repository (2025), machine-to-machine API data access is routed via the NIC API Exchange Gateway (NAPIX) with mandatory masking of personally identifiable information parameters. However, Clause 3.1 preserves sweeping exceptions, permitting unmasked data access for law enforcement agencies and entities specifically exempted by MoRTH.

Citizen participation in the National Transport Repository is compulsory under the Motor Vehicles Act, 1988. Drivers and vehicle owners cannot opt out, nor can they choose analogue record-keeping.

Three statutory mechanisms enforce this mandatory collection:

• Mandatory registers: Sections 25A and 62B of the Motor Vehicles Act, 1988 statutorily mandate the creation and maintenance of the National Register for Driving Licences and the National Register for Motor Vehicles.
• Penal sanctions: Section 192 imposes penal sanctions, including fines and potential imprisonment for operating an unregistered vehicle.
• Compulsory surrender of data: Citizens must surrender residential addresses, mobile numbers, and identity credentials or forfeit their statutory right to use public transport infrastructure.

This setup creates a sharp legal imbalance between citizens and public authorities. As highlighted in the Second Administrative Reforms Commission Fourth Report on Ethics in Governance, governance suffers when legal frameworks impose penal liability on citizens while providing sovereign immunity shields to public departments.

The state acts as a mandatory Data Fiduciary, seizing citizen details by statutory force without bearing custodial liability. A private breach allows users to leave the service. When a sovereign repository leaks, citizens remain legally trapped on the compromised platform, bearing continuous risks of identity theft and stalking.

The Digital Personal Data Protection Act, 2023 sets rules for digital privacy, yet its carve-outs shield public departments. Under Section 17(1) of the DPDP Act, 2023, specified state processing activities are exempt from the core obligations outlined in Chapter II—excluding subsections (1) and (5) of Section 8—while simultaneously stripping Data Principals of all rights under Chapter III and Section 16.

Executive power widens under Section 17(2)(a). This provision empowers the Central Government to exempt any notified instrumentality of the State from all provisions of the Act in the interests of sovereignty, integrity, state security, friendly relations with foreign states, or maintenance of public order. Broad wording allows routine databases to bypass data audits through executive notifications.

Routine state processing receives additional legal waivers. Under Section 17(4) read with Section 7(b) of the DPDP Act, 2023, state instrumentalities processing personal data to issue subsidies, benefits, services, certificates, licences, or permits are exempt from notice obligations under Section 5 and data erasure obligations under Section 8(7).

A narrow accountability requirement persists under Section 8(5) of the DPDP Act, 2023. It states that every Data Fiduciary must protect personal data in its possession or under its control by taking reasonable security safeguards to prevent personal data breaches. State instrumentalities are not exempt from Section 8(5) under Section 17(1). Furthermore, Section 8(6) obligates a Data Fiduciary to give intimation of any personal data breach to the Data Protection Board of India and to each affected Data Principal.

Enforcing Section 8 against public departments remains difficult due to the oversight body's design. Under Sections 18, 19, and 20 of the DPDP Act, 2023, the Data Protection Board of India consists of a Chairperson and Members appointed entirely by the Central Government on terms, tenures, and salaries determined exclusively by executive rules. While Section 29 provides that appeals against Board orders lie before the Telecom Disputes Settlement and Appellate Tribunal and subsequently to the Supreme Court of India, the absence of an independent selection commission leaves the primary regulator open to executive pressure.

The Indian Computer Emergency Response Team functions as the national nodal agency for incident response under the Information Technology Act, 2000. Under Direction No. 20(3)/2022-CERT-In issued on 28 April 2022 under Section 70B(6) of the Act, all government organisations, intermediaries, and body corporates must report 20 categories of cybersecurity incidents to CERT-In within six hours of noticing them. Non-compliance carries penal consequences under Section 70B(7), including imprisonment for up to one year, a fine up to ₹1 lakh, or both.

The directions also introduce technical log maintenance obligations. Entities must preserve Information and Communication Technology system logs within Indian jurisdiction for a rolling duration of 180 days to aid digital forensics under the CERT-In directions of April 2022.

Three systemic factors undermine this incident disclosure framework:

• Confined reporting channel: CERT-In's April 2022 directions mandate reporting exclusively to the technical nodal agency for containment purposes.
• No citizen disclosure duty: The framework imposes no statutory duty on government entities to publicly disclose cyber breaches or directly notify affected citizens whose personal records are compromised.
• Administrative suppression: State bodies fear public fallout and administrative reprimand, leading departments to treat incidents as internal system glitches rather than declared data breaches.

Consequently, citizens discover state repository breaches only when illicit marketplaces trade their records or when media outlets publish investigative reports.

The Supreme Court affirmed privacy as a fundamental right under Article 21. In Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), a nine-judge bench established that state interference with privacy must pass a four-fold constitutional test: legality, legitimate state aim, proportionality, and procedural safeguards against abuse.

Transport registries like VAHAN and SARATHI easily satisfy the initial constitutional benchmarks. Statutory legality is anchored in Sections 25A and 62B of the Motor Vehicles Act, 1988, which explicitly authorise national vehicle registries. The legitimate state aim is clear: standardising vehicle licensing, improving road safety, mitigating vehicle theft, and administering electronic tolling.

Constitutional violations occur under the tests of proportionality and procedural safeguards. In Justice K.S. Puttaswamy (Aadhaar-5J.) v. Union of India (2019), the Supreme Court stressed that sovereign data collection must employ the least intrusive means to achieve its administrative objective. Exposing unmasked residential addresses, owner identity profiles, and vehicle engine numbers through commercial bulk data sharing or unvetted external APIs directly violates the constitutional mandate of proportionality.

Procedural safeguards remain broken due to statutory carve-outs. When Section 17 of the DPDP Act strips citizen rights to access, correction, and erasure, it eliminates remedies against administrative neglect. Building vast state databases while removing external checks conflicts with the Puttaswamy constitutional standard.

Securing digital public infrastructure requires modernising administrative oversight and reforming existing statutory exemptions. Technical protocols must transition from reactive containment to verifiable independent audits.

Four institutional interventions are required to restore accountability:

• Independent vulnerability audits: As recommended in the Report of the Committee of Experts under the Chairmanship of Justice B.N. Srikrishna, public data fiduciaries require independent validation. All NIC repositories and sovereign digital registries should undergo mandatory, third-party algorithmic and vulnerability assessments conducted by Standardisation Testing and Quality Certification (STQC) and CERT-In empaneled external auditors.
• Narrowing Section 17 exemptions: As noted in the PRS Legislative Research Analysis of the Digital Personal Data Protection Bill, 2023, Parliament should narrow Section 17 by replacing subjective executive notifications with narrowly defined statutory categories subject to judicial review. Exempting state agencies from core notice and erasure rules should be restricted to defined national security operations, rather than extended to routine transport administration.
• Independent regulatory appointment: The Data Protection Board of India requires statutory appointment procedures insulated from executive discretion, mirroring constitutional bodies.
• Mandatory public breach notifications: Enforcing direct breach notifications to affected citizens within defined timeframes under Section 8(6) will eliminate administrative secrecy and ensure that the state exercises strict custodial duty over citizen data.

• The National Transport Repository consolidates records of over 390 million vehicles and 220 million driving licences across VAHAN, SARATHI, e-Challan, and FASTag systems on NIC infrastructure.
• Sections 25A and 62B of the Motor Vehicles Act, 1988 compel citizen registration under penal sanctions, while Section 17 of the DPDP Act, 2023 exempts state agencies from core obligations like notice, erasure, and data principal rights.
• While Section 8(5) of the DPDP Act requires state fiduciaries to maintain reasonable security safeguards, the Data Protection Board's complete executive appointment structure undermines independent enforcement against government bodies.
• CERT-In's April 2022 cyber directions mandate a six-hour breach reporting window under Section 70B(6) of the IT Act, 2000, but fail to mandate public breach disclosure to affected citizens.
• Exposing unmasked demographic data through sovereign registries fails the proportionality and procedural safeguards prongs of the four-fold privacy test established in Justice K.S. Puttaswamy (2017).
• Reforming public data governance requires independent STQC audits, narrowing Section 17 exemptions, and granting institutional autonomy to data protection authorities.