Draft:Unique Identification Authority of India (UIDAI)

1. What is UIDAI

1.1 Origins and Statutory Foundation

The Unique Identification Authority of India (UIDAI) issues, updates, and authenticates Aadhaar, the twelve-digit unique identification number assigned to Indian residents based on their demographic and biometric attributes. UIDAI functions as a statutory body under the Ministry of Electronics and Information Technology (MeitY), having been re-established on 12 July 2016 pursuant to the provisions of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016. Before its statutory creation, the body operated from 28 January 2009 as an attached office of the former Planning Commission of India, deriving its operational mandates from executive notifications rather than legislative enactments . During this foundational phase, Nandan Nilekani, co-founder of Infosys, served as its initial Chairman, providing technological oversight and administrative direction during the infrastructure ramp-up.

1.2 Administrative Growth and Scale of Operations

Since the launch of Aadhaar in 2010, the Unique Identification Authority of India (UIDAI) has evolved from an institutional mechanism for establishing a nationwide unique identification system into a statutory authority responsible for managing the Aadhaar lifecycle, including enrolment, authentication, updating of identity information, and the administration and security of identity records. The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act 2016 provided a statutory framework for these functions and established UIDAI as the statutory Authority responsible for implementing the Aadhaar system. The scale of its operations is reflected in the number of Aadhaar identities generated: according to UIDAI, 142.76 crore (1.4276 billion) Aadhaar numbers had been generated as of 16 September 2025. The administrative system extends beyond initial enrolment, encompassing demographic and biometric updates, authentication, and the continued maintenance of Aadhaar records. The first Aadhaar number was issued on 29 September 2010 to a resident of Tembhli village in Nandurbar, Maharashtra, marking the beginning of the nationwide implementation of the Aadhaar system. Over the subsequent fifteen years, the expansion from the first enrolment to more than 1.4 billion generated Aadhaar numbers illustrates the considerable administrative and technological scale of the system.

1.3 Platform Logic and Integration into Digital Public Infrastructure

Unlike traditional physical identity documents, Aadhaar is a proof of identity and does not by itself confer citizenship or domicile rights. The Aadhaar framework is administered by the Unique Identification Authority of India (UIDAI), which is statutorily responsible for issuing Aadhaar numbers and performing authentication under the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act 2016. Aadhaar authentication enables an authorised requesting entity to verify an Aadhaar number together with the identity information associated with it through UIDAI's authentication system. The Act also provides for the establishment and maintenance of the Central Identities Data Repository (CIDR), which contains information relating to Aadhaar numbers and associated identity information. Consequently, Aadhaar operates primarily as a digital identity and authentication infrastructure, rather than merely as a physical identity card. UIDAI's authentication framework is used by authorised entities, including banks, telecommunications service providers and government agencies, for identity verification and access to services. Aadhaar has also become an important component of India's Digital Public Infrastructure (DPI), alongside platforms such as the Unified Payments Interface (UPI) and DigiLocker, although these systems have distinct institutional and technological architectures. In the delivery of government benefits, Aadhaar is integrated with the Direct Benefit Transfer (DBT) framework, including through the JAM (Jan Dhan–Aadhaar–Mobile) Trinity, which links bank accounts, Aadhaar and mobile connectivity as part of India's broader financial-inclusion and benefit-delivery architecture.

2. Official Definitions of UIDAI

2.1 Related Terms: Section 2, Aadhaar Act 2016

Section 2 of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act 2016 defines several terms that establish the statutory framework within which UIDAI operates. Section 2(a) defines an “Aadhaar number” as an identification number issued to an individual under section 3(3). Section 2(g) defines “biometric information” to include a photograph, fingerprint, iris scan, or such other biological attributes as may be specified by regulations. Section 2(v) defines a “resident” as an individual who has resided in India for a period or periods amounting in all to 182 days or more in the twelve months immediately preceding the date of application for enrolment. Because this statutory definition is based on residence rather than citizenship, the Aadhaar framework is not restricted to Indian citizens; individuals who satisfy the statutory definition of “resident” may be eligible for enrolment.

2.2 Sections 3 and 7: Rights, Entitlements and Statutory Conditionality

The Aadhaar Act establishes both an entitlement to enrolment and circumstances in which Aadhaar may be used as a condition for accessing specified government benefits. Section 3 establishes that every resident is entitled to obtain an Aadhaar number, subject to the statutory enrolment process. This provision is directly relevant to UIDAI's functioning because it creates the statutory basis for the Authority's responsibility to administer the enrolment system and issue Aadhaar numbers to eligible residents. The corresponding institutional function is set out in section 23(1), which requires UIDAI to develop the policies, procedures and systems for issuing Aadhaar numbers and performing authentication. Thus, section 3 establishes the resident's statutory entitlement, while section 23 provides the institutional framework through which UIDAI administers that entitlement.

Section 7 permits the Central or State Government to require Aadhaar authentication, or proof of possession of an Aadhaar number, as a condition for receiving a subsidy, benefit or service for which the expenditure is incurred from the Consolidated Fund of India. The proviso to section 7 further requires the government to make alternative and viable means of identification available to an individual who has not been assigned an Aadhaar number. The interaction between the entitlement under section 3 and the conditional use of Aadhaar under section 7 is therefore significant to understanding how UIDAI's identification infrastructure interacts with the delivery of government benefits.

2.3 Sections 11 and 23: Constitution and Functions of UIDAI

Section 11(1) formally establishes the Unique Identification Authority of India as a statutory body corporate with perpetual succession and a common seal. Section 23(1) sets out UIDAI's core functions, including developing the policy, procedure and systems for issuing Aadhaar numbers to individuals who apply for enrolment and for performing authentication. Under section 23(2), the Authority is further empowered to specify demographic and biometric information required for enrolment; establish and operate the Central Identities Data Repository; make regulations relating to Aadhaar enrolment and authentication; regulate agencies involved in enrolment and authentication; and take measures to ensure the security of identity information and authentication records. These provisions establish the statutory basis for UIDAI's operational and regulatory role in administering the Aadhaar ecosystem.

The long title of the Act identifies its purpose as providing for the efficient, transparent and targeted delivery of subsidies, benefits and services and for expenditure incurred from the Consolidated Fund of India. This statutory purpose provides the broader legislative context within which UIDAI's identification and authentication functions operate.

3. Appearance in Official Documents

3.1 Judicial Scrutiny

In Justice KS Puttaswamy (Retd.) v Union of India (2017), a nine-judge Constitution Bench unanimously recognised privacy as a constitutionally protected right under Article 21 and the broader guarantees of Part III of the Constitution, establishing the constitutional framework against which subsequent restrictions on privacy would be assessed.¹ The Court's reasoning provided the foundation for examining whether an infringement of privacy was supported by law, pursued a legitimate state aim and satisfied the requirements of proportionality. In the subsequent Justice KS Puttaswamy (Retd.) v Union of India (2018), a five-judge Constitution Bench applied these constitutional principles specifically to the Aadhaar scheme and examined the validity of the Aadhaar Act 2016 and its implementation.² The majority, in the judgment delivered by Justice AK Sikri, upheld the core Aadhaar framework while imposing or identifying limitations on particular aspects of its operation. The Court considered the nature and extent of information collected for Aadhaar enrolment, including demographic and biometric information, and examined whether the statutory framework provided adequate safeguards against misuse. Thus, the 2017 judgment established the general constitutional standard for privacy, whereas the 2018 judgment applied that framework to UIDAI and the Aadhaar system specifically.

Conversely, Justice D.Y. Chandrachud issued a dissenting opinion, concluding that pervasive cross-verification across public and private platforms risked establishing a "state of the panopticon" by facilitating personal profiling . Justice Chandrachud highlighted a critical technical vulnerability: neither UIDAI nor the Central Government owns the source code for the proprietary automated biometric identification system (ABIS) de-duplication software. Because this core engine is leased from foreign commercial vendors, the dissent framed this licensing reliance as a national security risk and an institutional vulnerability.

3.2 Constitutional Oversight: Comptroller and Auditor General (CAG) Characterisation

In Performance Audit Report No. 24 of 2021, the Comptroller and Auditor General (CAG) of India described UIDAI as the statutory authority responsible for planning and formulating policies for the implementation of the Aadhaar project. The audit traced UIDAI’s institutional evolution from its establishment as an executive authority in 2009 under the Planning Commission to its statutory establishment under the Aadhaar Act 2016. It also examined the Authority’s operational processes, record-keeping practices, and internal mechanisms for verifying Aadhaar data.

3.3 Data Protection Framework: Justice B.N. Srikrishna Committee Evaluation

The Committee of Experts on a Data Protection Framework for India, chaired by retired Supreme Court Justice B.N. Srikrishna, submitted its report A Free and Fair Digital Economy in July 2018 . While avoiding direct commentary on pending constitutional challenges, the Committee identified regulatory gaps in the original Aadhaar Act. Specifically, it highlighted that the statute lacked explicit enforcement mechanisms empowering UIDAI to penalize non-compliant private entities operating within the broader authentication ecosystem . The Committee recommended amending the Aadhaar Act to introduce formal enforcement penalties and regulatory oversight—provisions that influenced the drafting of the Digital Personal Data Protection Act, 2023 , .

4. Technological transformation and Initiatives

4.1 UIDAI’s Administration of Different Aadhaar and Authentication Credentials

UIDAI administers different enrolment and authentication arrangements based on the status and circumstances of Aadhaar holders. These arrangements demonstrate how the Authority’s statutory and regulatory framework accommodates different categories of users while maintaining a common identification infrastructure.

• Aadhaar for adult residents: Aadhaar enrolment is available to individuals who satisfy the statutory definition of a “resident”, requiring residence in India for 182 days or more in the twelve months immediately preceding the date of application.
• Aadhaar for children below five years: UIDAI permits enrolment of children below five years without collecting their fingerprints or iris scans at the initial stage. The child’s Aadhaar is linked to the Aadhaar details of a parent or legal guardian, and mandatory biometric updates are required when the child reaches five years of age and again at fifteen.
• Aadhaar for NRIs: UIDAI provides a specific enrolment process for Non-Resident Indians holding a valid Indian passport. Unlike the general resident-enrolment requirement, NRIs may apply for Aadhaar without completing the 182-day residence requirement applicable to residents.
• Virtual ID (VID): UIDAI also administers the Virtual ID system, under which an Aadhaar holder can generate a temporary, revocable 16-digit number that may be used in place of the Aadhaar number for authentication or e-KYC, subject to the applicable UIDAI framework.

4.2 Authentication Modes and Exception Handling Mechanisms

UIDAI provides multiple authentication mechanisms to accommodate different technical and operational requirements. Demographic authentication verifies demographic information associated with an Aadhaar number against the information available in UIDAI’s Central Identities Data Repository (CIDR). Biometric authentication verifies biometric information, including fingerprints, iris scans and facial images, against the biometric information associated with the Aadhaar number. One-Time Password (OTP) authentication enables verification through a time-limited OTP sent to the Aadhaar holder’s registered mobile number or email address. Offline verification allows identity information to be verified without accessing the CIDR through mechanisms such as digitally signed QR codes and offline electronic Aadhaar documents.

Where biometric authentication is unsuccessful because of factors such as poor biometric quality or changes in biometric characteristics, the UIDAI framework provides for exception and alternate authentication mechanisms. Authentication agencies are required to make appropriate provisions for such cases, including the use of alternate authentication modes where available, rather than treating a failed biometric authentication as conclusive evidence that the individual cannot be authenticated.

4.3 Institutional Ecosystem: Registrars, AUAs, KUAs, and ASAs

The operational infrastructure administered by UIDAI involves a network of entities performing distinct enrolment and authentication functions. Registrars are entities authorised or recognised by UIDAI to undertake enrolment-related activities on behalf of the Authority. Enrolment Agencies (EAs) are engaged by Registrars to perform enrolment and update functions, including operating enrolment centres and capturing residents’ demographic and biometric information in accordance with UIDAI procedures. Authentication User Agencies (AUAs) are entities that use Aadhaar authentication services to verify the identity of Aadhaar holders, while e-KYC User Agencies (KUAs) are entities authorised to use the e-KYC service for identity verification. Authentication Service Agencies (ASAs) provide secure connectivity between AUAs or KUAs and UIDAI’s Central Identities Data Repository (CIDR), facilitating the transmission of authentication requests.

State Resident Data Hubs (SRDHs) should be treated separately from UIDAI’s statutory authentication-agency structure. SRDHs were developed as state-level databases integrating resident information with Aadhaar numbers to support state government service delivery and welfare programmes; their establishment and operation therefore arise from state-level administrative arrangements rather than from the same UIDAI regulatory framework governing Registrars, EAs, AUAs, KUAs and ASAs.

+-----------------------------------------------------------------------+
|              Unique Identification Authority of India                 |
|                               (UIDAI)                                 |
|                                  |                                    |
|             Central Identities Data Repository (CIDR)                 |
+-----------------------------------------------------------------------+
                                   |
             +---------------------+---------------------+
             |                                           |
             v                                           v
+--------------------------+               +--------------------------+
|  Enrolment Architecture  |               |  Auth & KYC Architecture |
+--------------------------+               +--------------------------+
| * Registrars             |               | * ASAs (Service Ag.)     |
| * Enrolment Agencies     |               | * AUAs (User Agencies)   |
| * Field Operators        |               | * KUAs (e-KYC Agencies)  |
+--------------------------+               +--------------------------+
             |                                           |
             +---------------------+---------------------+
                                   |
                                   v
             +-------------------------------------------+
             | State Resident Data Hubs (SRDHs - States) |
             +-------------------------------------------+

4.4 Mandatory versus Voluntary Application post-2018

The legal framework governing Aadhaar use was altered following the 2018 Supreme Court judgment and subsequent legislative amendments. While Aadhaar use may be required in circumstances authorised by law, the framework also permits voluntary forms of verification in specified contexts. In particular, offline verification requires the verifying entity to obtain the individual’s consent, inform the individual of available alternatives to sharing information, and refrain from collecting, using or storing the Aadhaar number or biometric information during the offline verification process.These safeguards distinguish offline verification from forms of authentication involving direct access to UIDAI’s authentication infrastructure and reflect the regulatory emphasis on consent and data minimisation in offline identity verification.

5. Recent Policy and Technological Expansions (2026)

5.1 Decennial Document Update Framework and Document Liberalisation

UIDAI has encouraged residents whose Aadhaar was issued ten years earlier and whose demographic information has not subsequently been updated to submit updated Proof of Identity (POI) and Proof of Address (POA) documents to support the continued accuracy of Aadhaar records. In 2023, UIDAI introduced a temporary waiver of charges for online document updates through the myAadhaar portal, while document updates at Aadhaar centres continued to attract the applicable fee.

The document framework was subsequently revised through the Aadhaar (Enrolment and Update) First Amendment Regulations, 2026. The amendment substituted Schedule II of the Aadhaar (Enrolment and Update) Regulations 2016 and expanded and reorganised the categories of documents that may be used as proof of identity, address, relationship and date of birth. The revised schedule includes documents such as voter identity cards and e-Voter identity cards, ration/PDS and e-ration cards, CGHS/ECHS/ESIC/Medi-Claim cards, marriage certificates, divorce decrees, MGNREGA/NREGS job cards, caste certificates and property-tax receipts, subject to the conditions specified for each document. This amendment therefore represents a significant expansion and rationalisation of the documentary framework administered by UIDAI.

5.2 Demographic Provisions for Minors, Foreign Nationals, and OCIs

UIDAI’s enrolment framework provides specific procedures for children and foreign nationals. For children below five years, Head of Family (HoF)-based enrolment may be undertaken using prescribed proof of relationship and proof of date of birth documents; the revised 2026 Schedule II expressly recognises documents such as birth certificates and, in specified circumstances, valid Indian passports and legal-guardianship documents.³ Mandatory biometric updates subsequently apply at the prescribed stages of childhood.

The 2026 Schedule II also contains separate documentary requirements for OCI cardholders, Long-Term Visa (LTV) holders and other foreign nationals. The applicable requirements and validity of Aadhaar for these categories depend on the holder’s immigration or nationality status and the documents prescribed by UIDAI; these categories should therefore not be treated as subject to a single uniform validity rule.

5.3 Mobile App-Based Self-Service and Processing Fee Waivers

UIDAI has expanded digital self-service facilities through its Aadhaar mobile application. The application provides Aadhaar holders with services including mobile-number and address updates, biometric locking and unlocking, selective sharing of Aadhaar verifiable credentials, authentication-history access and e-Aadhaar downloads. In June 2026, UIDAI further announced that the charge for updating an email address through the Aadhaar mobile application would be waived for six months, from 1 July 2026 to 31 December 2026. The waiver therefore applies specifically to email-address updates through the mobile application, rather than to all demographic updates undertaken through the application.

5.4 Open Innovation, Hackathons, and Technical Optimization

UIDAI has also used open innovation and data-driven initiatives to engage researchers and developers with the Aadhaar ecosystem. In 2026, UIDAI conducted the UIDAI Data Hackathon 2026, which focused on data-driven innovations relating to Aadhaar and inclusive governance. UIDAI has separately undertaken technical benchmarking initiatives, including biometric SDK benchmarking challenges, to evaluate and improve technologies used within the Aadhaar ecosystem. These initiatives demonstrate UIDAI’s use of external technical and analytical expertise alongside its internal operational infrastructure.

6. Coverage in Official and Primary Databases

6.1 UIDAI Aadhaar Dashboard

UIDAI maintains a publicly accessible Aadhaar Dashboard providing aggregate statistics on Aadhaar enrolment, updates, authentication, e-KYC transactions and registered devices. The dashboard also provides trend-based and state-level data visualisations, enabling researchers to examine the scale and geographical distribution of Aadhaar operations. The dashboard is therefore a primary administrative data source for analysing UIDAI’s operational performance and the evolution of the Aadhaar ecosystem.

6.2 UIDAI Monthly Press Releases and Transaction Metrics

UIDAI publishes operational statistics through its official press-release and media channels. These releases provide periodic information on authentication, e-KYC, enrolment and update activity. For example, UIDAI reported 221 crore Aadhaar authentication transactions in August 2025, representing a 10 per cent increase over August 2024. Such releases provide time-specific operational metrics that supplement the continuously updated Aadhaar Dashboard.

6.3 Statutory Annual Reports under Section 27

Pursuant to Section 27 of the Aadhaar Act, 2016, UIDAI submits an Annual Report containing its audited financial records, organizational expenditures, and operational summaries to the Central Government for parliamentary tabling . These self-authored publications represent the primary official account of the authority's administrative activities .

6.4 CAG Audit Report No. 24 of 2021

The Comptroller and Auditor General of India’s Report No 24 of 2021: Performance Audit on Functioning of UIDAI provides an independent external audit of UIDAI’s functioning. The performance audit examined the enrolment, update and authentication ecosystems, with the principal audit period covering 2014–15 to 2018–19, while figures were updated where information was available up to March 2021. The CAG reported that nearly 4.75 lakh duplicate Aadhaar numbers had been cancelled as of November 2019, based on information furnished by UIDAI’s Tech Centre. The report also identified deficiencies concerning enrolment documentation, de-duplication, authentication infrastructure, information security and grievance redressal.

6.5 Parliamentary Standing Committee Reports and Legislative Records

Parliamentary records provide another primary source for information concerning UIDAI. The Digital Sansad platforms allow researchers to search Lok Sabha and Rajya Sabha questions and answers by ministry, date, member and subject. These records contain official responses from the Ministry of Electronics and Information Technology concerning Aadhaar enrolment, authentication, security, data protection, implementation and related administrative matters. Parliamentary committee reports and debates can similarly be used to reconstruct legislative and institutional scrutiny of UIDAI.

6.6 Direct Benefit Transfer (DBT) Bharat Portal and PFMS

The DBT Bharat portal is an official Government of India platform maintained by the Direct Benefit Transfer Mission. It provides aggregate information on DBT schemes, transactions, funds transferred and state-level DBT performance. The portal also provides access to Aadhaar-bank-account linking information.

The Public Financial Management System (PFMS) is used within government payment and fund-flow processes and provides beneficiary payment-related information. The original statement that PFMS allows beneficiaries specifically to verify whether an Aadhaar number is “seeded to valid bank accounts” should therefore be narrowed: Aadhaar-bank linking information and payment-tracking functions should not be presented as the same service.

6.7 Judicial Databases and Unmapped Case-Level Data

Aadhaar-related litigation can be researched through several judicial databases, but these sources serve different purposes. The Supreme Court of India’s official database provides access to judgments, orders and case-status information, while the National Judicial Data Grid (NJDG) provides searchable case information and aggregated judicial statistics across courts. The NJDG describes itself as a searchable repository covering case information from district and subordinate courts, High Courts and, following integration, Supreme Court data.

However, these databases do not provide a single dedicated classification of Aadhaar litigation by issues such as authentication failure, denial of welfare benefits or biometric exclusion. Researchers therefore need to conduct case-level searches and manually classify relevant decisions. Commercial or independent repositories such as Indian Kanoon may supplement this research but should not be treated as substitutes for the official judicial databases.

7. Research that Engages with UIDAI

7.1 Privacy and Security of Aadhaar: A Computer Science Perspective

Computer science researchers at IIT Delhi conducted a technical audit evaluating the security architecture of the Aadhaar platform . The published paper identified architectural vulnerabilities associated with centralized biometric repositories, including potential user profiling risks, replay attack vectors, biometric spoofing risks, and supply-chain vulnerabilities within authentication hardware endpoints .

7.2 Aadhaar Failures in Food Services and Welfare

In the Economic and Political Weekly (December 2017), development economist Reetika Khera analyzed empirical field evidence concerning Aadhaar integration across the Public Distribution System (PDS), MGNREGA employment payments, and social security pensions. The study found limited empirical support for government claims regarding leak-reduction efficiencies, while documenting recurring instances where mandatory biometric authentication led to the exclusion of vulnerable households from statutory rations. Khera expanded these empirical findings in Dissent on Aadhaar: Big Data Meets Big Brother (2019).

7.3 State of Aadhaar: A People’s Perspective

The 2019 State of Aadhaar: A People's Perspective survey reported high population coverage (approximately 95 percent among adult residents), while noting that roughly 28 million adults remained unenrolled due to documentation barriers. While approximately 80 percent of respondents reported that Aadhaar simplified service access, a significant minority experienced recurring authentication failures that caused delays or complete denials of essential public benefits .

7.4 Rojer Mathew v South Indian Bank Ltd

Academic literature examining the design assumptions of large-scale Information and Communication Technology (ICT) projects argues that systems presupposing high digital literacy, stable internet connectivity, and physical biometric readability produce systemic exclusion. These studies contend that exclusion risks are inherent to the platform's architectural design rather than mere temporary operational glitches.

7.5 A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians

The 2018 Justice B.N. Srikrishna Committee report (A Free and Fair Digital Economy) identified structural governance gaps in the original Aadhaar framework . It highlighted that UIDAI lacked regulatory mechanisms to investigate and penalize non-compliant third-party entities operating within the external authentication ecosystem.

7.6 Call for better regulations on Aadhaar governance and privacy

Investigative reporting published in Siasat (November 2025) detailed recurring e-KYC authentication failures at Point-of-Sale (PoS) ration distribution terminals in southern India, tracing food entitlement denials to persistent biometric matching failures among manual laborers .

7.7 ID4D Global Dataset 2025

The World Bank's Identification for Development (ID4D) initiative documents Aadhaar as a benchmark model for foundational identity rollouts in low- and middle-income countries, emphasizing its cost-effective public-private enrolment ecosystem.

7.8 Justice K S Puttaswamy (Retd) v Union of India

Legal scholar Usha Ramanathan has published critiques tracing Aadhaar's shift from an opt-in welfare identifier to an expansive identity requirement . Her scholarship highlights legal risks concerning surveillance, data function creep, and foreign vendor licensing of central de-duplication software—arguments reflected in Justice Chandrachud's 2018 constitutional dissent .

8. International Comparative Analysis

8.1 Estonian X-Road Model: Centralised Biometrics vs Decentralised Data Exchange

In contrast to India's centralized biometric architecture, Estonia's digital identity network—built upon the X-Road (X-tee) data exchange layer launched in 2001—operates on a decentralized architecture . Personal data remains distributed across separate agency databases linked via encrypted, auditable exchange protocols. Estonian citizens monitor system usage through a personal dashboard that records every instance a state or private entity queries their identity data .

8.2 National Implementations: Nigeria (NIN) and Rwanda

• Nigeria: Modeled parts of its National Identification Number (NIN) framework on UIDAI's centralized system. By mid-2025, Nigeria's National Identity Management Commission (NIMC) had registered approximately 121 million residents toward a revised World Bank target of 180 million registrations by late 2026 .
• Rwanda: Developed a centralized national population register achieving over 98 percent population coverage, serving as an example of centralized identity administration within a smaller geographic context.

8.3 Judicial Halts and Regulatory Limits: Kenya's Huduma Namba

In Kenya, the government initiated a centralized biometric identification rollout named Huduma Namba in 2019. However, the Kenyan High Court issued rulings in January 2020 and October 2021 halting mandatory deployment until comprehensive Data Protection Impact Assessments (DPIAs) and statutory privacy frameworks were established.

8.4 European Union eIDAS 2.0 Decentralised Architecture

The European Union's updated eIDAS 2.0 regulatory framework (Regulation [EU] 2024/1183) mandates European Digital Identity Wallets managed directly by member states. The framework explicitly rejects centralized biometric repositories, adopting decentralized, privacy-preserving cryptographic verification standards .

8.5 Global Technical Export: MOSIP and International Deployments

The Modular Open Source Identity Platform (MOSIP)—developed at IIIT-Bangalore with philanthropic funding from the Bill & Melinda Gates Foundation, Tata Trusts, and Norad—adapts Aadhaar's core platform architecture into an open-source framework . MOSIP has been piloted or deployed in at least nine countries, including the Philippines, Morocco, Sri Lanka, Uganda, Ethiopia, and Sierra Leone [17]. The Philippine Identification System (PhilSys) represents the largest national deployment of MOSIP technology, registering over 71 million citizens by 2022 .

<+-----------------------------------------------------------------------------------+
|               Comparative Models of Foundational Digital Identity                 |
+-------------------+--------------------+--------------------+---------------------+
| Architectural     | Country / System   | Core Data Storage  | User Transparency   |
| Model             |                    | Architecture       | Features            |
+-------------------+--------------------+--------------------+---------------------+
| Centralized       | India (Aadhaar)    | Single CIDR        | Virtual ID, App-    |
| Biometric         |                    | Repository         | based lock          |
+-------------------+--------------------+--------------------+---------------------+
| Decentralized     | Estonia            | Distributed X-Road | Real-time citizen   |
| Data Exchange     | (e-ID / X-Road)    | Databases          | audit logs          |
+-------------------+--------------------+--------------------+---------------------+
| Decentralized     | European Union     | User-held Digital  | Zero-knowledge      |
| Digital Wallet    | (eIDAS 2.0)        | Wallets            | proofs              |
+-------------------+--------------------+--------------------+---------------------+
| Modular Open-     | Philippines        | Distributed or     | Configurable by     |
| Source (MOSIP)    | (PhilSys / MOSIP)  | Centralized        | adopting nation     |
+-------------------+--------------------+--------------------+---------------------+

9. Data Challenges

9.1 Data Access Gaps and Reliance on Institutional Self-Reporting

Public understanding of Aadhaar's systemic operational metrics relies almost entirely on self-reported data released by UIDAI via its public dashboard and annual publications . As noted in CAG Audit Report No. 24 of 2021, external oversight remains constrained when auditing bodies receive data only "to the extent... furnished" by the authority.

9.2 Downstream Data Breaches and SRDH Security Risks

Data security incidents highlight vulnerabilities located in external, downstream databases rather than within the core CIDR . Prominent incidents—including a 2017 incident where the Kerala pension portal exposed 3.5 million resident records and a 2018 vulnerability on a state-owned LPG distributor platform—involved exposed State Resident Data Hubs (SRDHs) and external API endpoints. While UIDAI maintained that the central CIDR remained uncompromised, these downstream incidents exposed sensitive resident information due to weaker security protocols in secondary systems.

9.3 Unresolved Constitutional and Legislative Questions

Two structural legal questions remain unresolved in Indian jurisprudence:

1. The Seven-Judge Money Bill Reference: Following Rojer Mathew v. South Indian Bank Ltd. (2020), the question of whether passing the Aadhaar Act as a Money Bill violated Article 110 of the Constitution was referred to a seven-judge Constitution Bench, which remains pending adjudication .
2. Statutory Alignment with DPDP Act, 2023: Reconciling the sector-specific Aadhaar Act, 2016 with the horizontal Digital Personal Data Protection Act, 2023 requires explicit legislative modifications regarding data retention, consent mechanisms, and independent regulatory oversight .

10. Way Ahead

The challenges identified in relation to Aadhaar indicate that future reforms should focus not only on expanding the system’s functionality but also on strengthening its legal safeguards, security architecture, implementation mechanisms and institutional accountability. The policy proposals discussed in the literature emphasise the need to preserve the benefits of Aadhaar while addressing concerns relating to privacy, data protection, authentication failures, legislative uncertainty and institutional oversight.

10.1 Harmonisation with the Digital Personal Data Protection Act, 2023

A principal area for reform is the alignment of the Aadhaar framework with the Digital Personal Data Protection Act 2023. The Aadhaar ecosystem involves the collection and processing of extensive personal and biometric information, making consistency between the Aadhaar Act 2016 and the broader data-protection framework particularly important. Legislative reform should therefore clarify the relationship between the Aadhaar Act and the data-protection obligations applicable to the processing, retention, security and disclosure of personal data.

Such harmonisation could include clearer statutory limits on data retention, stronger requirements concerning purpose limitation and consent where consent is legally applicable, and accessible procedures for correction and updating of personal information. It should also clarify the respective responsibilities of UIDAI, authentication agencies, requesting entities and other entities participating in the Aadhaar ecosystem. These reforms would reduce regulatory overlap and provide individuals with clearer rights and remedies concerning the use of their Aadhaar-linked information.

The approach is consistent with the broader policy recommendation that Aadhaar's legal framework should evolve alongside India's data-protection regime rather than operate as an isolated identity framework. The Justice B N Srikrishna Committee had previously emphasised the importance of a comprehensive data-protection framework capable of protecting individual privacy while facilitating legitimate digital governance.

10.2 Adjudication of the Seven-Judge Money Bill Reference

A second area requiring resolution is the constitutional uncertainty arising from the manner in which the Aadhaar Act was enacted. The Supreme Court's judgment in Rojer Mathew v South Indian Bank Ltd raised the question of whether legislation substantially dealing with matters outside the scope of Article 110 of the Constitution could validly be enacted as a Money Bill. The issue was subsequently referred for consideration by a larger Constitution Bench.

Final adjudication of the reference would provide greater constitutional clarity concerning the permissible scope of the Money Bill procedure. Such clarification is particularly significant for Aadhaar because the original statutory framework was enacted through that procedure. A definitive ruling would establish a clearer constitutional standard for determining when legislation containing financial provisions, but also creating substantial institutional and individual rights and obligations, may be certified as a Money Bill.

The reform required at this stage is therefore not necessarily a substantive alteration of the Aadhaar architecture, but authoritative constitutional clarification regarding the legislative procedure through which foundational legislation may be enacted. This would strengthen legal certainty and reduce the possibility of comparable constitutional disputes surrounding future digital-governance legislation.

10.3 Independent Auditing and Open Tracking Frameworks

The effectiveness of Aadhaar should also be evaluated through independent and publicly verifiable measures rather than relying exclusively on aggregate administrative data. A comprehensive monitoring framework could periodically assess authentication failure rates, exclusion from welfare schemes, demographic disparities in authentication outcomes, grievance-resolution rates and the effectiveness of alternative authentication mechanisms.

Independent audits could be conducted at regular intervals by institutions with technical, statistical and social-policy expertise. The resulting findings could be published in accessible formats, allowing researchers and policymakers to compare authentication performance across States, schemes and population groups. This would complement UIDAI's administrative reporting with independent empirical evidence.

The State of Aadhaar research demonstrates the value of large-scale independent studies in assessing enrolment, authentication and experiences with public-service delivery. Similar periodic studies could therefore be institutionalised as an external accountability mechanism. Rather than treating authentication success as the sole measure of system performance, evaluation should also examine whether individuals were ultimately able to obtain the service or entitlement for which Aadhaar authentication was required.

Such an approach would allow policymakers to distinguish between technical authentication failures and broader exclusion arising from connectivity problems, inadequate infrastructure, documentation difficulties, lack of awareness or failures in grievance redressal. The policy proposals identified in the literature similarly support stronger implementation and monitoring mechanisms to ensure that technological failures do not undermine the objectives of Aadhaar.

10.4 User-Centric Privacy Enhancements and Independent Institutional Oversight

Aadhaar's privacy architecture should also increasingly place individuals in a position to understand and exercise meaningful control over the use of their identity information. Existing mechanisms such as Virtual IDs, biometric locking and offline verification provide users with alternatives to the unrestricted disclosure of their Aadhaar number and biometric information. These mechanisms should be accompanied by greater transparency regarding when, why and by whom Aadhaar-linked information is accessed.

One possible reform is the development of user-accessible audit trails through which individuals can review authentication and access activity associated with their Aadhaar identity. Such a system could provide information regarding the requesting entity, date and purpose of an authentication or other permitted access. Greater visibility into data use would enable individuals to identify potentially unauthorised activity and strengthen institutional accountability.

Privacy safeguards should also extend beyond the individual user interface to the wider Aadhaar ecosystem. Independent technical audits could periodically assess authentication software, enrolment infrastructure, security controls, third-party service providers and mechanisms for protecting biometric information. The objective would be to ensure that security is evaluated throughout the identity ecosystem rather than solely at the central database level.

Finally, institutional oversight should be strengthened through clearly defined accountability mechanisms for entities that misuse Aadhaar information or fail to comply with applicable security and data-protection requirements. Independent monitoring would reduce the risk of conflicts of interest where the institution responsible for administering the identity infrastructure is also the principal body assessing its operation. A combination of technical audits, transparent reporting, effective grievance redressal and independent oversight would therefore provide a more comprehensive accountability framework.

Taken together, these reforms would shift the Aadhaar framework from an emphasis primarily on identification and authentication towards a broader model of secure, rights-conscious and accountable digital identity governance. This would allow the system's infrastructure to continue supporting welfare delivery and digital public services while strengthening safeguards against privacy violations, exclusion, security vulnerabilities and institutional misuse.

11. Also Known As

• Aadhaar Authority
• UID Authority of India
• "The Authority" (Statutory definition under Section 2(e) of the Aadhaar Act, 2016)
• UID (Unique Identification) Project (Historical reference to the 2009–2016 executive initiative)