Private firms accessed India's vehicle databases 17 million times before data sharing was halted
Private companies made almost 17 million queries to India's national vehicle registers between Jan 2024 and Sep 2026 before the government stopped sharing the data on Oct 1, according to an RTI reply from the National Informatics Centre.
An RTI request by the Internet Freedom Foundation disclosed that the National Informatics Centre granted 25,314 credentials to private firms, allowing access to India's VAHAN, SARATHI and other transport databases. Between January 2024 and September 2026 those firms submitted 17,079,998 queries, extracting owners' names, addresses, insurance details and vehicle identifiers. On Oct 1 the Centre stopped sharing this data with private entities after instructions from the Ministry of Road Transport and Highways, though the NIC did not disclose the rationale or exact timing.
The IFF had earlier highlighted a popular vehicle-information app that, for a fee, revealed full owner details, and a Telegram service selling records for ₹5 per lookup, suggesting authorized access was being misused. The NIC confirmed a June 1 disclosure to CERT-In about such sales but said it could not provide details on credential revocations. API logs are retained for one year and SMS logs for six months, raising questions about evidence preservation. IFF is seeking a public list of credential holders, clarification on whether the cut-off is permanent, and stronger safeguards to prevent resale of personal data.
Why it matters
It reveals massive private access to personal vehicle data and prompts government action on privacy safeguards.
In this story
