Student databases for Rs 1,500? The dark side of India's exam boom

The CBSE OSM portal controversy has already dragged on for weeks. Students and evaluators complained of glitches, delays, technical errors and confusing interfaces. What should have been a routine academic process turned into a frustrating ordeal for many users trying to navigate the system.

Now, allegations around the NTA re-exam portal have added fresh questions about whether educational platforms are adequately protecting student information. In recent days, teenagers themselves have flagged what they believe are security concerns, reigniting debate over how safely student data is being handled.

But amid discussions about coding errors, portal failures and cybersecurity flaws, Career360 founder Maheshwer Peri has pointed to a much bigger and potentially more troubling problem.

According to Peri, India's student data may already be circulating in an open marketplace where databases are allegedly sold for as little as Rs 1,500, often filtered by class, city, state, educational board or exam category.

If true, the issue is no longer whether a particular portal has vulnerabilities.

It is whether student information has become one of India's most valuable commercial products.

In a post on X, Peri claimed that student databases are openly available despite the existence of the Digital Personal Data Protection (DPDP) Act and other safeguards.

"I am not surprised at all. It is for this very same reason that student data bases are up for sale for as low as Rs.1500. You can ask for it at a class level, city level or state level. All these are openly sold in the market despite MeitY_NICSI and DPDP Act," he wrote.

Peri went further: "There is no way they can access such data unless there is collusion."

The allegation is serious. While there is no evidence linking the recent CBSE or NTA controversies to any sale of student information, Peri's comments raise questions that extend far beyond a single portal or examination.

FROM GLITCHES TO A DATA ECONOMY

The CBSE OSM and NTA controversies do not prove that student data was sold.

But they have forced attention onto a question that rarely enters public debate: what happens to student information after it is collected?

Every exam form, registration portal and admission platform creates another repository of names, phone numbers, email addresses and academic records. As education has moved online, the volume of student data being generated has exploded, making every alleged security lapse more significant.

Because behind every portal is a database. And behind every database is a potential market.

WHY INDIA IS A GOLDMINE FOR STUDENT DATA

The answer lies in scale.

India has more than 260 million students enrolled across schools and higher education institutions, a population larger than most countries.

Every year, millions appear for board examinations, entrance tests and recruitment-linked assessments. CBSE alone handles roughly 3.5 million to 4 million students across Classes 10 and 12 annually, while NTA's major examinations, including JEE Main, NEET and CUET, collectively touch more than 10 million aspirants every year.

That creates an enormous pool of potential customers.

A Class 10 student today may become a coaching student next year. A Class 12 candidate may be looking for a university. An engineering aspirant may later become a target for certification programmes, recruitment platforms, study-abroad consultants or postgraduate admissions.

We also cannot ignore the sheer size of India's education business. The country's edtech market is already worth about $7.5 billion, while the coaching industry is valued at around $6.5 billion.

Combined, that is a market of roughly $14 billion, with coaching institutes, colleges, universities, edtech firms, study-abroad consultants, lenders, scholarship platforms and recruiters competing for the same students.

A 2025 industry report by enrolment platform Meritto, based on an AI-driven analysis of 23 million student leads, found that digital channels generated nearly 72% of all student leads and drove about 62% of total enrolments.

In an industry built on finding the next customer, access to student information can be incredibly valuable.

Even if a company gained access to just 1% of a student population of 250 million, it would still have a database of roughly 2.5 million potential leads.

A database of students is not just data. It is a sales pipeline.

And that helps explain why somebody might pay Rs 1,500, or much more, for a targeted database containing thousands of potential leads.

STUDENT DATA IS BIG BUSINESS WORLDWIDE

The idea of buying and selling student information is not unique to India.

Researchers at Fordham Law School in the United States documented an entire commercial marketplace built around student data. Their research found that student lists could be purchased based on characteristics ranging from affluence and ethnicity to lifestyle indicators, interests and predicted behaviours.

The study described a largely opaque ecosystem in which data brokers collected, packaged and sold student information with limited transparency.

The College Board's Student Search Service offers another example of how valuable student information has become. Through the programme, students can choose to share information with colleges and universities seeking prospective applicants. More than 1,900 institutions have participated, showing how institutionalised the use of student data has become within parts of the education sector.

Privacy researchers say the broader data broker industry has evolved into a multibillion-dollar global business, with student information forming one niche within a much larger marketplace built around personal data.

In other words, student information is no longer just educational data. It is marketing data.

And if such markets exist in countries with mature privacy frameworks, the questions become even bigger in India, where the student population is far larger and data protection laws are still being rolled out.

WHY INDIA MAY BE AN EVEN BIGGER TARGET

India's education ecosystem is enormous. Schools, coaching institutes, colleges, universities, edtech platforms and study-abroad consultancies are all competing for the same pool of students.

Acquiring those students costs money. The Indian edtech sector alone has spent hundreds of millions of dollars over the years on customer acquisition, advertising and lead generation.

In that environment, student data becomes a shortcut.

A quick online search reveals websites openly advertising school databases, coaching databases and education leads. Some claim to offer segmentation by city, age group, educational level, board affiliation and examination category.

Whether every database being advertised is genuine is one question. Whether the information being sold is accurate is another.

But the fact that such marketplaces openly advertise access to student information raises obvious concerns.

If databases can be sold with this level of specificity, where exactly is the information coming from?

As Peri put it: "There is no way they can access such data unless there is collusion."

DATA PROTECTION LAWS EXIST. ENFORCEMENT IS STILL EVOLVING

India's Digital Personal Data Protection Act, 2023 establishes rules for how personal information can be collected, processed and shared.

The law is built around consent and purpose limitation. Selling student information without appropriate authorisation could raise serious legal concerns.

Yet India's data protection framework is still being implemented. Rules, enforcement mechanisms and oversight structures are continuing to evolve.

That creates a difficult reality: laws may exist on paper while questionable data practices continue in plain sight.

This is one reason Peri's comments have resonated with many observers. They point to a possibility that concerns extend beyond isolated portal glitches and into the broader ecosystem handling student information.

THE STUDENTS ARE DOING THE AUDITING

Perhaps the most striking aspect of recent controversies is who has been uncovering them: students.

In recent months, teenagers have repeatedly shared screenshots, documented alleged flaws and raised concerns when they believed systems were exposing information or behaving unexpectedly. The pattern mirrors a growing global trend in which digitally savvy users are often the first to spot privacy issues and security weaknesses.

If students can identify alleged vulnerabilities in some of the country's most important education portals, what does that say about the broader ecosystem handling student data?

A QUESTION BIGGER THAN CBSE OR NTA

The CBSE and NTA controversies may eventually pass. Technical problems can be fixed. Portals can be redesigned. Security safeguards can be strengthened.

But Peri's comments point to a much larger issue.

If student databases are genuinely available for purchase at such low prices, then the debate is no longer about one website, one exam or one portal.

It becomes a question about an entire data economy built around India's students.

Parents spend years worrying about marks, ranks and admissions. Perhaps it is time to ask different questions.

Who has access to their children's information? How did they get it? And why does this data appear to be worth so little to buy but so much to sell?

The real question raised by the CBSE and NTA controversies is not whether a single portal had a flaw.

It is whether India's education system has become part of a much larger data economy in which students are no longer just exam candidates, but products.

This story is part of an ongoing India Today investigation. In Part 2, we go inside the student data marketplace, examining the records being advertised for sale and the claims made by those selling them.