How Indian Job Portals Handle — and Sometimes Leak — Your Resume Data

A resume is one of the most complete personal profiles you will ever create: your full name, phone number, personal email, current employer, salary, location and a timeline of your career. When you upload it to a job portal, you are handing all of that to a platform whose business model is, in part, selling access to it.

This is not a scandal — it is how the industry openly works. But understanding it helps you decide what to expose and what to lock down.

How resume data is legitimately packaged for sale

Major Indian job portals sell recruiters paid access to their candidate databases. Naukri, for example, markets a product literally called Resume Database Access (RESDEX), which lets recruiters search and view candidate resumes as part of a subscription.

That means the moment your resume is "searchable", paying recruiters — and anyone who has bought a recruiter seat — can pull your name, contact details, salary expectations and history. Most of the time this is used for genuine hiring. But the same access is a magnet for:

• Fake recruiters who harvest contact details to run job scams.
• Lead-generation resellers who scrape profiles to build calling lists.
• Insurance and loan tele-callers who buy or scrape "working professional" segments.

When it goes wrong: the leaks

Legitimate access is one risk. Breaches are another. Indian job portals have a track record of large exposures:

• In May 2020, cybersecurity researchers found personal data of around 29 million (2.9 crore) Indian job seekers offered for sale on the dark web, sourced from job portals. The records included name, address, email, phone, current employer, salary and job field. Analysis later indicated much of it dated back to 2006–2012 — old, but still enough to phish or profile someone.
• Data of around 1.4 million IIMjobs users was separately alleged to have leaked on the dark web.
• More recently, a mobile API flaw on Naukri was reported to expose recruiter email addresses to unauthorised users before it was patched.

The lesson is not "never use job portals" — most people have to. It is that resume data is unusually rich, unusually widely shared, and has repeatedly ended up where it should not.

What actually happens to your number after you apply

Once your details are in circulation, they rarely stay in one place. A single "working professional, 5–10 years experience, Bengaluru" record can be copied into dozens of calling lists. That is why applying for jobs is so often followed by a wave of loan, insurance and "premium membership" calls — the same phone number, resold many times.

How to limit your exposure

You cannot un-send a resume, but you can shrink your footprint:

1. Set your profile to private / not-searchable when you are not actively job-hunting. On most portals this stops recruiters from pulling your contact details out of RESDEX-style databases.
2. Use a dedicated email for job applications, separate from your banking and primary identity.
3. Trim old accounts. Delete resumes and profiles on portals you no longer use — old data leaks just as easily as new data.
4. Use the portal's available removal route. Check the portal's account, privacy, unlisting, or grievance process and keep a record of the request. The DPDP Act's Section 12 commencement is scheduled; do not assume an unverified request has a particular legal effect.
5. Verify recruiters. A real recruiter can be found on the company's official site. If a "job offer" arrives on WhatsApp asking for a registration fee, it is a scam — see our guide on common scams in 2026.

The bottom line: your resume is a high-value target precisely because it is so complete. Keep it private when you are not searching, minimise the accounts that hold it, and use the portal's privacy, account-deletion, unlisting or grievance route. A request is not proof of deletion. Scan your data to check whether your job-portal email or number appears in a known breach.