Field research

Before the State Enforces, It Publishes

What Indian government result and merit lists publish about candidates, and what law allows it

14 September 2026 · about 14 minutes · Research cutoff: 14 September 2026

What this is: Original research into five official result and merit lists published by central, state and Union Territory bodies, and a search for the legal basis on which each carries the personal details it does. Every document was opened and every provision quoted was read in the primary text.
The finding in one line: The Staff Selection Commission's final result for its largest graduate examination prints, for each candidate provisionally shortlisted, the father's name, mother's name and category codes that include orthopedic, hearing and visual disability. The Commission's current 132 page examination notice gives no basis for publishing a mother's name at all. The Union Public Service Commission announces its qualifiers with a roll number and a name, and nothing else.
What it does not say: Nothing here establishes that any body has broken a law in force today. Most duties under the DPDP Act commence on 13 May 2027. The question is narrower: when the State becomes the regulator of everyone else's personal data, is its own publishing limited to what the purpose needs?

On 13 November 2025, one provision of the DPDP Act came into force immediately.

It rewrote the Right to Information Act. Clause (j) of section 8(1) used to let a public authority refuse personal information unless a larger public interest justified disclosure. Section 44(3) of the DPDP Act replaced it with a single phrase: "information which relates to personal information".¹ ³ The public interest override is gone. A citizen who files an RTI application asking for another person's details can now be refused on that ground alone.

The Government's case for that change is privacy. It is a serious case, and it is now before a Constitution Bench of the Supreme Court.⁶

This article asks a simpler question. If personal information is too sensitive to release to a citizen who asks for it, why does the State publish it, unasked, to everyone?

Methodology

Five official documents were opened directly from government websites on 14 September 2026, using the exact public addresses at which each is served. Only the column headings, legends and covering notices were read. No candidate's name or record was copied, stored or reproduced, and the downloaded files were deleted after reading. No identifier was entered into any search form, no filename was guessed and no login was used. The robots.txt file of every host was read first. This article deliberately does not link to any list of candidates, because a data protection article that sends readers to a list of named people would be adding to the problem it describes. The examination notice and the result write up that are linked contain no candidate data.

1. What five government lists publish

Each of these documents is a public announcement with a legitimate purpose: telling candidates whether they qualified, and letting anyone check that the selection was fair. The question is not whether to publish. It is what each one publishes alongside the result.

Staff Selection Commission, Combined Graduate Level Examination 2025, final result

A 297 page list of candidates provisionally shortlisted in the final result, in roll number order. Its column headings, as printed: ROLL, NAME, FATHERNAME, MOTHERNAME, CAT1, CAT2, CAT3, POSTSEL, CATS. The pages carry a legend explaining the codes:

"0=EWS, 1=SC, 2=ST, 3=ESM, 4=OH, 5=HH, 6=OBC, 7=VH, 8=PWD-Other, 9=UR"

OH, HH and VH are the Commission's codes for orthopedic, hearing and visual disability. ESM is ex serviceman. So a reader can see, against a named person and both of that person's parents, whether that person has a disability and of what kind.

The Commission's own result write up gives the scale. It provisionally recommended 15,118 candidates, including 162 under OH, 154 under HH, 154 under VH and 148 under other disabilities: 618 people whose disability category now sits beside their parents' names on the open web.⁸

Union Public Service Commission, Civil Services (Preliminary) Examination 2026

A 505 page name wise list of candidates who qualified for the Main examination. Its headings: SR. NO., ROLL NO., NAME. That is all. No parent, no date of birth, no category.

AICTE, Saraswati Scholarship Scheme merit list, 2024 to 25

A 38 page list with four columns: Student Unique Id, Student Name, AICTE (PID), Institute Name. Two identifiers per student, but no family or category detail.

Directorate of Medical Education, Assam, NEET UG 2025 provisional selection list

A 163 page scanned document. Its headings include roll number, NEET rank and score, DME application number, state rank, name of the candidate, Category, Sub Category and Special Category, and the allotted college. The covering notice directs candidates selected under the PwD (Divyang) category to report for verification of their disability status by a Medical Board.

A government college of education in the Andaman and Nicobar Islands, B.Ed merit list 2026 to 27

A one page provisional merit list dated 21 August 2026. Its headings: Admission Number, Candidate Name, Father's Name, Date of Birth, Category, Merit Percentage, Remarks. A full date of birth beside a name and a father's name is, in practice, most of what is needed to impersonate someone. The college is not named here because the point is the pattern, not one small institution.

2. The fix already exists inside government

The UPSC list is the most important document in this article, and it is the least interesting one to read.

It announces who qualified in the most competitive examination in the country, and it does so with a roll number and a name. It proves that public verification of a selection does not require a parent's name, a date of birth or a disability code. Nobody can argue that transparency in recruitment is impossible without them, because a constitutional body already runs one of India's largest examinations without them.

So the gap between SSC and UPSC is not a gap between transparency and secrecy. It is a gap between two design choices, made by two bodies under the same Government, for the same kind of announcement.

3. We looked for the law that allows it

A public body that publishes personal data should be able to point to the rule that tells it to. So we read the Commission's own Notice of Examination for CGL 2026, the current edition of the 132 page document that governs the CGL recruitment from application to allocation, published on 21 May 2026.⁷ The 2025 notice under which the result above was run could not be located on the Commission's website at the research cutoff, so the quotations below are from the current notice and are not claimed to be identical to the earlier one.

It contains one provision on publishing candidate details. Paragraph 21 reads, in part:

"In accordance with the directions issued by DOPT vide its O.M. No.39020/1/2016- Estt. (B) dated 21.06.2016 for increasing access of the unemployed candidates to job opportunities it has been decided that after declaration of final result the Commission will make the scores and rankings in the said open Competitive Examinations conducted by the Commission available on its website in descending order of ranking."

It then lists ten fields: name, father or husband's name, date of birth, category (including PwBD and ESM), gender, educational qualifications, total marks, ranking, complete address and email address. And it adds:

"However, the candidate will have the option, at the time of filling up of his application form, from opting out of disclosing the above details publicly. Accordingly, the scores and rankings in respect of only those candidates who have opted for disclosing the above details or else have not exercised their option will be made available on the website of the Commission."

Four things follow from the Commission's own words.

The stated source is an office memorandum, not an Act of Parliament or a statutory rule. It is an executive direction from the Department of Personnel and Training.
Its stated purpose is job access for unsuccessful candidates, so that other employers can find people who came close. That purpose explains a name, a score and a way to contact the candidate. It does not explain a disability category shown to the whole internet.
It works by default. A candidate who does not find and exercise the option at the time of applying is published, with a home address and an email address.
It says nothing about the final result list. Paragraph 21 concerns scores and rankings made available after the result. We found no provision anywhere in the notice that requires the final list of selected candidates to carry a mother's name. The notice asks for the mother's name only so that the application matches the matriculation certificate.

For scale, a word count of the whole notice: "personal data" appears 0 times, "consent" 0 times, and "privacy" once, in the medical examination standards, about decency during a physical examination.

4. Why the legal basis matters so much

The DPDP Act does not apply to personal data that is made publicly available by "any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available".¹ That is section 3(c)(ii)(B), and it is the defence any public body will reach for.

It has a consequence that is easy to miss. The exemption attaches to the data, not to the body. If a result list genuinely falls within it, the Act does not reach that data in anyone's hands: not the coaching site that republishes it, not the data broker that scrapes it, not the fraudster who matches a name, a father's name and a date of birth to a phone number. Once the State publishes under a legal obligation, nobody downstream owes that candidate anything under this Act.

That is exactly why the obligation should be real, and why it should be narrow. Two open questions decide the matter, and this article does not pretend to settle them:

whether an office memorandum is a "law for the time being in force" in the sense section 3(c)(ii)(B) intends; and
even if it is, whether an obligation to publish scores and rankings for job access extends to a mother's name and a disability code in a separate list of selected candidates.

If the answer to either is no, the lists sit inside the Act from 13 May 2027 like any other processing.

5. What the DPDP Act will ask of the State

There is no blanket exemption for government. Section 17(2)(a) takes processing outside the Act only for an instrumentality the Central Government actually notifies, and only in the interests of sovereignty, security of the State, friendly relations with foreign States, public order or preventing incitement to related offences.¹ An examination result is none of those.

Section 17(4) is narrower still. For processing by the State it removes three things: the duty to erase under section 8(7), the right to erasure under section 12(3), and, where no decision affecting the person is being made, the right to correction under section 12(2).¹ Notice, security safeguards, breach intimation, a published contact, access and grievance redressal all survive.

Read that carefully, because it makes over publication worse, not better. A candidate whose disability category is published beside their parents' names cannot rely on the Act to have it erased. The State's route out of the erasure duty is the reason it should publish less in the first place.

Where the State relies on its legitimate use for services, certificates and similar functions under section 7(b), the Rules set written standards in the Second Schedule. The third of them reads: "Processing is limited to such personal data as is necessary for such uses or achieving such purposes".² Where it relies instead on consent, section 6(1) requires consent to be "free, specific, informed, unconditional and unambiguous with a clear affirmative action".¹ A default that publishes anyone who did not find an opt out is not a clear affirmative action.

Whichever route applies, the answer to "is a mother's name necessary to announce a result?" is supplied by UPSC.

6. The Constitution does not wait for May 2027

The DPDP Act is phased. The Constitution is not. Since the nine judge bench decision in Justice K.S. Puttaswamy (Retd.) v. Union of India, privacy has been recognised as a fundamental right under Article 21, and any intrusion by the State must be backed by law, pursue a legitimate aim and be proportionate to it.⁵

Proportionality is minimisation by another name. It asks whether the State could achieve the same aim with less intrusion. A roll number and a name achieve the aim of announcing a result. A father's name, a mother's name and a disability code add intrusion without adding verification. That test binds every public body today, and it did not need a new statute to do so.

7. The contradiction, stated plainly

The same framework now lets a public authority tell a journalist, a researcher or a rival candidate that it will not release information because it "relates to personal information". The Supreme Court declined to stay that amendment on 16 February 2026 and referred the challenges to a larger bench.⁶

Meanwhile, without any application being filed, government lists put parents' names, dates of birth and disability categories on the open web, in machine readable form, for anyone to download.

The two are not the same legal act. Answering a third party's RTI request and proactively publishing a list for a separate administrative purpose are different processing contexts, under different authority. But they concern substantially similar information about the same people, and that leaves an uncomfortable question. If privacy justifies withholding personal information when a citizen asks for it under RTI, what justifies publishing substantially similar personal information to everyone without being asked? That is a question of proportionality, and it deserves an answer.

This is not an argument that the State is acting in bad faith. It is an argument that the State is about to regulate the entire country's handling of personal data, through a Board it appoints, and that its own publishing habits were designed before anyone asked what is necessary.

8. What a minimal result list looks like

None of this is expensive. It is a column deletion, and a few decisions.

Publish roll number and name. That is the UPSC standard, and it is enough for public verification.
Remove parents' names and full dates of birth from public lists. They are identity verification data. They belong at document verification, not on the website.
Publish category and disability counts in aggregate, as the SSC result write up already does, and keep the person level category with the candidate's own login.
Make any disclosure for job access an opt in, with a plain statement of which fields will be public and for how long, and never a home address.
Set a period after which a list comes down or moves behind a roll number lookup, and say what that period is.
Name a contact for questions about published lists, as the Rules will require from every Data Fiduciary.
Write the publication rule down in the examination notice itself, field by field, so that the legal basis is something a candidate can read before applying.

9. The verdict: the regulator should be the first to comply

Private companies in India are being told, correctly, that the DPDP Act asks them to collect only what they need, to tell people what they do with it, and to be able to prove consent. They will be judged on that from 13 May 2027 by a Board the Government constitutes.

The State's result lists are the most visible personal data processing many Indians will ever encounter from their Government. Most of them are published for good reasons. Some of them publish far more than those reasons need, on a basis that, in the case we examined most closely, the Commission's current notice describes as an office memorandum about job access, applied by default unless a candidate opts out.

The evidence also contains the solution. UPSC already publishes the minimum. The gap is not capability. It is attention, and there are eight months left in which to give it.

Source note

The five lists were opened on 14 September 2026 at the addresses on which the issuing bodies serve them. They are identified by issuing body and title rather than linked. Column headings and legends are quoted exactly as printed. The candidate counts are taken from the Staff Selection Commission's final result write up, not from counting rows. The DPDP Act and Rules were read in the Gazette text. This article makes no claim about any candidate, and no claim about whether any other law requires any list to be published in its current form; where that question is open, the article says so.

References

#DPDP #DataProtection #Privacy #RTI #SSC #UPSC #DataMinimisation #GovTech #DigitalIndia

General information about the DPDP Act 2023 and the DPDP Rules 2025, not legal advice. This is a public evidence assessment, not an audit finding.

DPDP Roles, explained simply