For sale: Your salary info, address, and phone number — How Info Edge's Naukri is monetising the trust of millions

extract

Your private data has a price. It is Rs 2,500 for one month or Rs 9,000 for six. For that amount, anyone, whether a real estate agent, loan DSA, car salesperson or another individual, can potentially gain access to contact details, 60 to 300 complete professional profiles, and the personal information of millions of Indians who uploaded their resumes while looking for jobs. If you are a founder, CXO or senior executive, you've almost certainly received unsolicited calls from people you never contacted. Most dismiss them as spam. Few ask how these callers know their phone number, salary details, home address and professional history. Entrackr's investigation traced one possible source, leading directly to one of India's most trusted job platforms. The salesman who came to sell data, not jobs It began not with a sting operation or a tip-off, but with a walk-in. A sales executive representing Naukri.com arrived at the building where Entrackr's office is located to meet another company. He walked into our office, introduced himself, showed his company identification and began pitching Naukri's recruiter subscription. What he was effectively selling was access to data. His pitch was explicit and detailed. He explained that Naukri's database contains the personal information of millions of Indian professionals, including CXOs, senior executives and employees across industries. Through the subscription, users could access phone numbers, email, residential addresses, salary details and complete professional profiles. We made our purpose equally explicit. "Hume CXO ka data chahiye, hume hiring nahi karni hai." We told him we wanted CXO data for business development and sales, not for recruitment. The response was revealing. He neither questioned our purpose nor declined the request. Instead, he opened the product, conducted a live demonstration and agreed to sell us the subscription despite knowing we had no hiring requirement. Entrackr possesses the complete audio recording of the conversation, along with the executive's name, designation and company identification. The subscription: what Rs 2,500 actually buys To understand what was on offer, consider Naukri's own recruiter subscription plans. A one-month plan priced at Rs 2,500 includes two SMB job postings, unlimited applies with instant CV recommendations from Naukri's database, 60 CV views and 250 NVites, allowing direct access to 250 candidates' personal contact information. The six-month plan, priced at Rs 9,000, increases this to 300 CV views and 1,250 NVites. Every plan also promises "unlimited applies with contact details available." Yet there is no independent verification that a job posting is genuine or that the subscriber has an actual hiring requirement. There is another critical aspect that the subscription page does not highlight. Once recruiter access is granted, candidate profiles can be downloaded and exported into Excel files. That means phone numbers, email addresses and other personal details can leave the platform entirely, beyond Naukri's technical control, with little visibility into where the data goes or how it may ultimately be used. The demo: Zomato VPs, OYO directors, on screen in minutes What followed was not a routine sales pitch. It was a live demonstration of how easily professional data could be accessed. The executive searched for VP and Director-level employees at Zomato (Eternal) and OYO (PRISM), pulling up complete profiles, contact details and professional and personal information within minutes. Entrackr cross-checked several of the profiles against contact details already in our possession. They matched. When we asked about filtering candidates who had been active in the last two months, a feature meant to identify recent job seekers, he suggested removing the filter altogether. Since we had already told him we were not hiring and only wanted CXO data for business development, removing the filter would simply provide more profiles and more contacts. This was not an executive questioning our stated purpose. He was showing us how to maximise access despite knowing there was no recruitment requirement. The enterprise rate card reinforced the scale of access: Rs 2,000 for 50 credits, Rs 1.2 lakh for 5,000, Rs 1.7 lakh for 10,000 and Rs 2.5 lakh for 25,000. One credit unlocked one complete professional profile, including phone number, email address, salary, employment history, and residential address. There is no way to track who is using data for what During the conversation, the sales executive made a remark that went to the heart of the issue. He acknowledged that the database was meant for hiring but added that companies use it in different ways, and "there is no way to track who is using data for what." To illustrate the point, he cited two prominent companies. According to him, a leading telecom company had purchased a recruiter subscription worth Rs 1.5 crore, while a major used-car retailer had paid Rs 25 lakh. Entrackr could not independently verify these figures. He further speculated that while such subscriptions are purchased in the name of hiring, these companies could also use the data to market and sell their products. Entrackr treats this as the sales executive's pitch, not as a verified fact. The comments stood in sharp contrast to Naukri's written response, which highlighted KYC checks, access controls, monitoring and legal action against misuse. He went further. When Entrackr asked what should be told if a candidate questioned how their contact details were obtained, he replied that there was no way for anyone to know the data came from Naukri and suggested saying someone had referred them. The That was presented as a practical workaround during the sales conversation. Not a loophole. not a misuse. A sales target. In its written response and during a meeting with Entrackr's journalists, Naukri maintained that recruiter access is meant solely for hiring, subscribers are contractually bound to use the data only for recruitment, and any misuse is a violation of its terms and conditions. But the sales executive described a very different reality. When asked whether such sales were common, he replied candidly: "We have been selling this from the beginning, but now these sales are increasing." He added that he had a quarterly sales target of Rs 10 lakh, with 70% to 80% of his salary fixed and the remainder linked to achieving that target. When Entrackr said it wanted an individual subscription rather than a corporate one, he initially said such plans had been discontinued. Moments later, he said, "Let me try," and proceeded to arrange one anyway. The executive also claimed, "Humara 70-80% market share hai. Koi bhi company ka employee Naukri pe profile banayega hi banayega." Those remarks raise a fundamental question: if access to millions of resumes is being sold against revenue targets, where does recruitment end and data monetisation begin? Real estate companies are already using it. And they say it works. The investigation did not end with Naukri's sales executive. A founder of a Gurugram-based real estate company, speaking on condition of anonymity, told Entrackr: "For Rs 2,500 we get access to verified contacts of high net worth individuals. No real estate lead platform gives us this quality of data at this price." According to the real estate founder, the company was not using the subscription for hiring. Instead, it was using verified mobile numbers, email addresses, salary ranges and designations to target professionals for residential and commercial property sales. Entrackr found that such companies maintained active Naukri subscriptions despite having no recruitment requirement. It offers one possible explanation for the unsolicited real estate calls many Indian professionals receive and why the callers often seem to know far more than they should. The revenue question In an interaction, Naukri told Entrackr that more than 90% of its recruitment revenue comes from recruitment consultants and enterprises, with individual subscriptions contributing only a small share. But that figure does not distinguish between enterprises using the platform for hiring and those using recruiter access for other purposes. Info Edge's recruitment business generated about Rs 650 crore in Q4 FY26, making it the company's largest business. During the investigation, Entrackr found that real estate companies using an active recruiter subscription despite having no hiring requirement, while Naukri's sales executive continued the sales process after being told the subscription would be used for business development. If regulators or Info Edge's board require stronger verification of hiring intent or restrict recruiter access to verified employers, the subscriber base could be affected. The executive also said recruiter subscriptions were being sold increasingly to meet quarterly sales targets. Together, these findings raise an important question for shareholders and analysts: how much recruitment revenue depends on subscribers whose primary purpose is not hiring, and what would stronger data protection enforcement mean for future growth? A listed company's responsibility Info Edge is not a startup operating in a regulatory grey zone. It is a listed company and should be accountable for all personal data it provides to anyone other than the recruiter. Globally, listed companies are expected to maintain effective controls over employee conduct and the handling of customer data. The sales executive Entrackr interacted with was using the company's product, official rate card and sales process while pursuing sales targets. That raises questions beyond one employee's conduct to the adequacy of the systems, oversight and incentives governing the product. For a listed company entrusted with the personal data of millions of Indians, the issues raised by this investigation extend beyond an individual sales interaction. They touch upon data protection practices, internal controls and ethical compliance. The DPDP Act: what the law actually says India's Digital Personal Data Protection (DPDP) Act, 2023, is built around principles that are directly relevant to Entrackr's findings. The law requires personal data to be processed only for the specific purpose for which consent was obtained. Professionals upload resumes to Naukri to seek employment opportunities, expecting access by genuine recruiters, not for unrelated commercial activities. It also incorporates the principle of data minimisation, requiring only the minimum data necessary for the stated purpose to be processed. Crucially, the Act places responsibility on the data fiduciary, not the subscriber. Naukri, as a data fiduciary, is responsible for ensuring lawful processing and cannot rely solely on contractual declarations by users. According to Vasundhara Shankar, Managing Partner at Verum Legal, allowing data collected for recruitment to be accessed or used for an unrelated purpose without fresh, specific consent could conflict with the Act's purpose limitation principle, with the responsibility resting on the data fiduciary. In an email response to Entrackr, Naukri said that it is preparing for full alignment with the DPDP Act ahead of its May 2027 implementation deadline. However, the transition period is intended to help companies build compliance systems, not to dilute the Act's underlying principles. Once constituted, the Data Protection Board of India will have powers to impose penalties of up to Rs 250 crore for significant violations, making data governance a material issue for listed companies. Five questions Naukri's response cannot answer Naukri's written response describes a framework of contractual restrictions, access controls, monitoring and grievance mechanisms. But several of those safeguards appear difficult to reconcile with what Entrackr documented during its interaction with the company's sales executive. The company said recruiter data cannot be used for commercial purposes and that misuse attracts suspension. Yet the executive said there is "no way to track who is using data for what," raising questions about how misuse is detected or enforced. Naukri also said it declines subscriptions where non-recruitment intent is evident. However, Entrackr explicitly stated it was seeking CXO data for business development, not hiring, and the sales process continued. The company cited grievance mechanisms as a safeguard. But candidates are not notified when their profiles are accessed or downloaded, making it difficult for them to know if their data has been misused. It also pointed to subscription limits as a control. Yet once access is granted, candidate profiles can be downloaded and exported, placing the data beyond the platform's technical control. Together, these issues raise a broader question: are contractual safeguards and post-facto enforcement sufficient when the data, once accessed, can leave the platform permanently? The MSME argument and why it doesn't answer the core question Naukri argued that India's hiring ecosystem extends beyond large companies and that MSMEs, startups and local businesses also need affordable access to recruitment tools. That is a reasonable position. But supporting genuine hiring by small businesses is different from granting recruiter access without independently verifying hiring intent. Entrackr's investigation found that access was offered even after it explicitly stated it was not hiring. The central question, therefore, is not who should recruit, but what verification should be required before access to millions of resumes is granted. Once accessed, it cannot be unaccessed There is a permanent asymmetry at the heart of every data privacy breach. Once a phone number has been viewed, it cannot be unviewed. Once a salary, residential address or employment history has been downloaded into an Excel file, it cannot be made private again. The damage occurs the moment access is granted, not when a complaint is filed. The implications extend far beyond unsolicited sales calls. Complete professional profiles containing contact details, salary information, employer history and residential addresses can enable targeted fraud, impersonation, scams and even physical security risks, particularly for founders, CXOs and senior executives. Entrackr is sharing the findings of this investigation, including audio recordings, transcripts and the sales material, with the Ministry of Electronics and Information Technology and the Data Protection Board of India, seeking their assessment of whether the practices documented are consistent with India's data protection framework. As India builds a digital economy increasingly dependent on trust, the debate is no longer just about data access. It is about whether the safeguards protecting that data are strong enough before access is granted. The global standard India is moving towards Across major digital economies, using personal data beyond the purpose for which it was collected attracts severe regulatory consequences. In the United States, the California Consumer Privacy Act (CCPA) gives consumers the right to know how their data is used and to opt out of its sale, with intentional violations attracting penalties of up to $7,500 per violation. In the European Union, the General Data Protection Regulation (GDPR) treats purpose limitation as a core principle, with penalties of up to 4% of a company's global annual turnover, and enforcement actions have resulted in billion-euro fines. In the United Kingdom, the Information Commissioner's Office (ICO) has imposed multi-million-pound penalties for misuse of personal data. Across these jurisdictions, the responsibility rests with the organisation collecting the data. India's Digital Personal Data Protection (DPDP) Act is built on the same principles of purpose limitation and accountability. What needs to happen For every founder, CXO and professional who has wondered how strangers obtained their number, salary details or other personal information, this investigation offers one possible explanation. And for Naukri, the key question remains: if, as its sales executive said, there is "no way to track who is using data for what," are the platform's safeguards sufficient? Naukri's response Before publishing this story, Entrackr sent Naukri a detailed questionnaire covering recruiter verification, privacy safeguards, misuse prevention and compliance with the Digital Personal Data Protection (DPDP) Act. Entrackr also met the company's senior leadership for more than an hour to discuss its findings. Naukri said jobseeker trust is fundamental to its platform and that candidate information is accessible only within a controlled recruiter framework for legitimate hiring purposes. It said recruiters are contractually required to post genuine jobs, use candidate data only for recruitment and comply with applicable laws. The company added that KYC checks, subscription-based access limits, system monitoring and grievance mechanisms help prevent misuse, while confirmed violations can result in suspension, termination or legal action. Naukri also said it has declined subscriptions where non-recruitment intent was evident and is preparing for full compliance with the DPDP Act before its May 2027 implementation deadline. However, the company did not directly address Entrackr's specific questions regarding the conduct of its sales representative, the rate card shared during the interaction, the sales targets described by the executive, or the absence of any technical restriction preventing downloaded candidate data from leaving the platform. The complete questionnaire sent by Entrackr and Naukri's full responses are available in the attached PDF. Editor Note: This investigation is based on recorded conversations with a Naukri.com sales representative, documentary evidence including the platform's subscription details and rate card, written responses from Info Edge, and independent corroboration from multiple sources. All recordings and documents are in Entrackr's possession and have been reviewed and verified independently before publication.