This was revealed in response to a Right To Information (RTI) application filed by digital rights advocacy Internet Freedom Foundation (IFF). Private entities made nearly 17 million queries to India’s national vehicle databases between January 2024 and September 2026, in the months before the Centre discontinued data sharing with such firms on October 1.
The official Parivahan portal masks several of these details and requires an account verified through a mobile OTP. IFF subsequently wrote to the Ministry of Road Transport and Highways (MoRTH), NIC and the Indian Computer Emergency Response Team (CERT-In), seeking an investigation into how the information was reaching private services. However, neither the reason for the decision nor the date on which the direction was issued was disclosed.
The National Informatics Centre (NIC), which runs the systems, disclosed that 25,314 credentials were issued to private entities during the period, allowing them to access data from VAHAN, SARATHI and related transport databases. The reply also recorded 338 credentials for private entities against 62 for government bodies, though it did not explain the difference between the two figures. It also filed RTIs with MoRTH and NIC on September 22, seeking details of private entities with access to the databases and action taken against alleged misuse. On October 20, IFF said NIC’s reply, dated October 16, confirmed that private data sharing was discontinued from October 1, following directions from MoRTH.
IFF said it could not establish whether the decision was linked to its representation, its RTI applications or a separate government review.
There was no immediate reaction from the NIC or MoRTH at the time of filing this report. MoRTH, meanwhile, disposed of IFF’s RTI application within two days, directing it to the ministry’s website and saying implementation of the Motor Vehicles Act fell under state and Union territory governments. IFF has challenged the ministry’s response and is filing a first appeal against NIC’s reply. The organisation has also called for a public list of entities granted access to transport data and stronger technical safeguards to prevent the resale of personal information.
The organisation also found that the vehicle information app it had tested remained available on Google Play Store as of October 17, continuing to advertise access to vehicle owners’ personal details.
NIC told IFF that API logs were retained for one year and SMS logs for six months, raising concerns about whether records needed for an investigation would remain available.
IFF has sought clarity on whether the move is permanent, whether recipients must delete previously obtained records, and whether vehicle owners will be informed about the unauthorised access While the discontinuation of private data sharing is a significant step.
