Privacy Alert: Student Data From CUET, Board Exams Being Sold Online For Rs 1,000

New Delhi: Information about millions of students who have taken the CUET 2026 in India and even other examinations organised by schools is now said to be on sale through a number of different sites on the internet. This has happened amid the implementation of the DPDP (Digital Personal Data Protection) Act in the nation. Some sites are selling students' names, mobile numbers, email addresses, dates of birth, names of their parents, and other personal details for between Rs 1,000 and Rs 10,000.

Who Is Selling CUET Aspirants' Personal Data

This surprising revelation comes to highlight the lack of security for students who have appeared for the national-level entrance exams (CUET) as well as school board exams in India. What is even more worrying is the fact that the cost of this database varies between Rs 1,000 and Rs 10,000 based on the size of the database and demographic segmentation (state, city, category). There is a specific website that is offering the "CUET-2026 Examination Database" consisting of more than 1.5 million candidates.
As per media reports, there are over half a dozen such websites, which are selling this data to private universities, colleges, and admission consultants.

What information is included in the leaked data?

According to media reports, the database is said to hold highly confidential information, including the candidates’ application number, name, phone number, email ID, parents’ names, date of birth (DOB), gender, and quota category. As per the news, the website has even provided the details of 500 candidates who had appeared for the CUET-UG 2026 test as a free live example. This testing agency conducted the exam from May 13 to June 3, and the result was declared on July 4.

What makes this so dangerous?

The public sale of students' personal data goes completely against the principles of the Digital Personal Data Protection (DPDP) Act. Under this strict law, violations of data privacy can attract penalties of up to ₹250 crore. However, the deadline for organisations to comply with the main implementation rules has now been extended to May 2027, which these hackers and websites may be exploiting.

How did NTA respond to this?

The National Testing Agency (NTA) mentioned that safeguarding the data of candidates is their utmost concern. It is reported that the entire process of sending the exam credentials and scores to universities is highly secure and based on mutual consent and takes place only via government portals like DigiLocker, NAD, and API Setu.