Exposed API reported to have returned student records without authentication

Potential DPDP Relevance

Unconfirmed reports still merit a check. Organisations may wish to review whether their own API endpoints enforce authorisation on every path that returns personal data, and whether unauthenticated access attempts would be detected.

• Access control
• API security
• Detection capability

This is practitioner guidance on what an organisation might review. It is not legal advice, and it is not a finding that any organisation has failed to comply with the DPDP Act. Nothing here states that a contravention occurred unless an authoritative source has established it.