Road Ministry seeks CERT-In audit of VAHAN, SARATHI over data on sale
The Ministry of Road Transport and Highways (MoRTH) has sought a forensic security audit of its VAHAN, SARATHI, e-Challan and PUCC portals by the Indian Computer Emergency Response Team (CERT-In). The move follows reports of vehicle-owner data being sold through apps and websites for as little as ₹5. It has also asked MeitY to review its data-sharing policy, officials said.
Syllabus: GS2 · Statutory & Regulatory Bodies; GS2 · Governance & e-Governance; GS3 · Cyber Security & Money Laundering
Why this matters for UPSC
GS III cyber security and GS II governance. Prelims can ask CERT-In's role under section 70B of the IT Act versus the NCIIPC under section 70A, and the DPDP Act's breach duties; Mains, how the state should share citizens' data safely.
Why it matters
A registration number is printed on every vehicle, so anyone who notes it down could buy the owner's home address, phone number and father's name for a few rupees. Such details could make stalking, harassment or targeted fraud easier. Owners cannot opt out: registering a vehicle and holding a driving licence are legal requirements, so the state collects this data by compulsion and owes a matching duty to guard it. Insurers, banks and other firms rely on the same records, which is why officials want tighter access, not a halt to sharing. How the Ministry closes the gaps will shape public trust in India's data protection regime.
Prelims pointers
- Section 70B, IT Act, 2000: CERT-In may call for information and issue directions; non-compliance can draw up to one year's jail, a fine up to ₹1 crore, or both.
- CERT-In Directions, 28 April 2022: government organisations too must report incidents such as data breach and data leak within 6 hours and keep ICT logs 180 days in India.
- Section 70A, IT Act, 2000 provides for a national nodal agency to protect Critical Information Infrastructure: the National Critical Information Infrastructure Protection Centre (NCIIPC).
- DPDP Act, 2023, Schedule: penalties may reach ₹250 crore for failing to take reasonable security safeguards and ₹200 crore for not reporting a personal data breach.
- Rule 7, DPDP Rules, 2025, from May 2027: affected persons and the Board learn of a breach without delay; the Board gets details within 72 hours unless it allows longer.
- K.S. Puttaswamy v Union of India (2017): a nine-judge bench held the right to privacy intrinsic to life and personal liberty under Article 21 and part of Part III.
- VAHAN and SARATHI were standardised and deployed by the National Informatics Centre (NIC) for MoRTH; State transport departments co-hold, as co-Data Fiduciaries, their State-level data.
- MoRTH's data-sharing policy: law-enforcement and security agencies see unmasked personal data; private recipients get selected fields under a daily cap; recipients need a Security Audit Certificate from a CERT-In-empanelled auditor.
Practise a UPSC-style question
With reference to the Indian Computer Emergency Response Team (CERT-In), consider the following statements:
1. It is appointed under section 70B of the Information Technology Act, 2000 as the national agency for cyber incident response.
2. Failing to comply with its directions is punishable with imprisonment of up to one year, a fine of up to ₹1 crore, or both.
3. It is the national nodal agency for the protection of Critical Information Infrastructure under section 70A of the Act.
Which of the statements given above is/are correct?
- (a) 1 and 2 only
- (b) 2 and 3 only
- (c) 1 and 3 only
- (d) 1, 2 and 3
Show the answer
Answer: (a) 1 and 2 only
Answer: (a) 1 and 2 only. CERT-In works under section 70B; protecting Critical Information Infrastructure is the NCIIPC's job under section 70A.
Statement 1: correct. Section 70B of the IT Act, 2000 has the Centre appoint CERT-In as the national agency for cyber incident response.
Statement 2: correct. Section 70B(7) punishes a failure to give information or obey a CERT-In direction with up to one year's jail, a fine up to ₹1 crore, or both; the Jan Vishwas Act, 2023 raised the fine from ₹1 lakh.
Statement 3: incorrect. The nodal agency under section 70A is the National Critical Information Infrastructure Protection Centre (NCIIPC), a separate body.
Eliminate: Statement 3 is surest: the section 70A agency is the NCIIPC, not CERT-In. Out: (b), (c), (d).
Trap: Swapped attribution. The NCIIPC's mandate under section 70A is pinned on CERT-In, the better-known cyber agency, so the statement sounds right.
Remember: Section 70A: NCIIPC protects Critical Information Infrastructure; section 70B: CERT-In responds to cyber incidents.
More from the 25 October 2026 edition
- Bundibugyo Ebola: TUMAINI vaccine trial starts in DR Congo; outbreak reaches Nigeria Sci-Tech
- MHA's Ladakh draft: proposed Article 371K body, regulations need L-G assent Polity
- DGHS bars reuse of single-use medical devices in all hospitals National
- AgriStack and the Farmer ID: how India's farmer registry works Economy
- DRDO's Air Independent Propulsion module for submarines enters Setting to Work Phase-2 Defence