New Delhi, July 9 -- Several websites are openly selling databases containing the personal details of students who sat for national entrance and school board examinations this year. The unchecked trade has raised fresh concerns over student privacy safeguards just as the Digital Personal Data Protection (DPDP) Act is being rolled out in phases. Websites such as studentdataprovider.com, studentsdatabases.com, studentdatahub.com, studentsdatabase.net, bulkstudentdata.com, and studentdatabaseindia.com are advertising student registries to universities and admission consultants for enrolment outreach and lead generation. Prices range from Rs.1,000 to Rs.10,000, depending on size and demographic filters. One listing on studentdataprovider.com fields a "CUET-2026 Exam Database" containing more than 1.5 million candidate records. The leaked fields include application numbers, candidate names, mobile numbers, email addresses, parents' names, dates of birth, gender, and quota categories. The portal shared a free sample containing details of 500 candidates who appeared for the Common University Entrance Test for Undergraduate (CUET-UG) 2026, conducted by the National Testing Agency (NTA) between May 13 and June 3, with results declared on July 4. The sale runs contrary to the intent of the DPDP Act, under which personal data must only be processed for the specific purpose for which it was collected and generally with individual consent. It provides for penalties up to Rs.250 crore for certain violations. Key compliance obligations for organisations handling personal data are scheduled to take effect in 2027. Students whose details appeared said they have been flooded with unsolicited calls The data companies defended the practice....