Aadhaar is India's national digital identity: a unique number issued by the Unique Identification Authority of India (UIDAI) and linked to the holder's demographic and biometric data, which other organisations can verify online. It underpins much of India's digital public infrastructure, so banks, telecom operators, fintechs and government services that onboard Indian customers meet it constantly, through authentication, e-KYC, Virtual IDs and offline verification. Each of those routes has different security properties and different legal duties, and the Digital Personal Data Protection Act 2023 now sits on top of the Aadhaar Act. This explainer covers how Aadhaar authentication and e-KYC work, what changes with the Virtual ID and paperless offline e-KYC, where the real risks lie for relying organisations, and how to design an integration that holds up. It is written for identity architects, compliance teams and security leaders; for a side by side comparison with other national schemes, see the National Digital ID Schemes Map.
Key takeaways
- Authentication answers yes or no. UIDAI states that Aadhaar authentication returns a Yes or No response without disclosing personal information, and is a one to one match against the number presented, not a search.
- e-KYC is stricter than authentication. UIDAI says e-KYC may only be carried out with OTP or biometric authentication; a demographic match alone is not enough.
- The relying party is the weak point. Most exposure comes from organisations that collect, store or log Aadhaar numbers, copies of cards and e-KYC data, not from UIDAI's core repository.
- Consent and alternatives are legal duties. The Aadhaar Act requires consent and notice before authentication and bars sharing core biometric information, and UIDAI says people without Aadhaar must be offered alternate viable means of identification.
- DPDP adds a second regime. The DPDP Act 2023 sets consent standards and penalties of up to 250 crore rupees for failing to take reasonable security safeguards against personal data breaches.
What it is
Aadhaar is governed by the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 (18 of 2016), as amended by the Aadhaar and Other Laws (Amendment) Act, 2019. UIDAI holds the enrolment data in the Central Identities Data Repository (CIDR) and runs the authentication service, which UIDAI says operates in active-active mode across its Hebbal and Manesar data centres. Organisations that ask UIDAI to authenticate people are "requesting entities". UIDAI is explicit that authentication does not by itself confer or prove citizenship or domicile: Aadhaar proves that a person is the holder of a number, nothing more.
Digital public infrastructure (DPI) is the wider idea: shared, government-backed digital rails for identity, payments and data exchange that private and public services build on. Aadhaar is the identity layer that other Indian DPI services draw on for onboarding and verification. The security lessons apply to any country building a similar stack: a single national identifier becomes a high-value target wherever it is copied.
How it works
Authentication modes
| Mode | What is matched (UIDAI) | Allowed for e-KYC | Main risks for the relying party | Use it for |
|---|---|---|---|---|
| Demographic | Aadhaar number plus demographic details against the CIDR record | No | Anyone who knows a person's details can pass; weak against impostors | Low-risk data checks only |
| OTP | Time-limited one-time PIN sent to the registered mobile number or email | Yes | SIM swap, OTP phishing and social engineering by agents | Remote onboarding at moderate risk |
| Biometric | Fingerprint, iris or other modality against stored records | Yes | Device tampering, spoofed fingerprints, operator fraud at assisted points | Assisted, in-person onboarding |
| Multi-factor | Two or more of the above combined | Yes, when it includes OTP or biometric | More friction; fallback paths become the weak point | High-value transactions and account recovery |
e-KYC
With e-KYC the requesting entity, after a successful OTP or biometric authentication and the holder's consent, receives identity data from UIDAI (such as name, address, photo and date of birth) to complete customer due diligence. Unlike plain authentication, e-KYC moves personal data into the relying party's systems, which is where most of the obligations and most of the risk begin. See the Identity Proofing and KYC Guide for how e-KYC fits into broader due diligence.
Virtual ID
The Virtual ID (VID) is a revocable number that stands in for the Aadhaar number during authentication, so the holder need not disclose the Aadhaar number itself. UIDAI states that only the holder can generate a VID, that it can be replaced from time to time and that only one VID is valid for an Aadhaar number at any time. Holders generate it through the myAadhaar portal, the mAadhaar app or by SMS to 1947. For relying parties, accepting VIDs reduces how many Aadhaar numbers they collect in the first place.
Paperless offline e-KYC
Offline e-KYC lets the holder download a UIDAI-signed XML file and give it directly to an organisation, without a live call to UIDAI. According to UIDAI:
- Integrity: the XML carries UIDAI's digital signature, which the receiving agency verifies against UIDAI's public certificate to detect tampering.
- Confidentiality: the file is a password-protected ZIP encrypted with a share phrase the holder chooses and passes to the agency.
- Minimisation: the full Aadhaar number is not included; a reference ID made of the last four digits and a timestamp is used instead, mobile number and email are hashed, the photo is low resolution and the holder chooses which fields to include.
- Liveness is the agency's job: the agency can confirm the person with its own OTP check against the hashed mobile number or by comparing a live face capture with the photo.
- Privacy trade-off: UIDAI notes that it does not necessarily learn that the data was shared, because the holder shares it directly.
Choosing a route: use online OTP or biometric e-KYC where regulation requires it and you have the licence; use offline e-KYC to avoid handling the Aadhaar number at all, but always verify the signature and the person; accept VIDs wherever you authenticate; never treat a photocopy or image of an Aadhaar card as verification, since anyone can copy one.
Why it matters
Legal duties for relying organisations
| Source | Duty | What it means in design |
|---|---|---|
| Aadhaar Act s.8 | Consent before collecting identity information for authentication; notice of the nature of information shared, its uses and alternatives | A consent screen per authentication, with the alternative route shown |
| Aadhaar Act s.29(1) | Core biometric information must not be shared with anyone for any reason | Never store or forward raw fingerprints or iris images; capture devices pass them encrypted straight to authentication |
| UIDAI authentication rules | Use identity information only for submission to CIDR; offer alternate viable means to people without Aadhaar | No secondary use of captured data; a non-Aadhaar onboarding path |
| DPDP Act 2023 s.6 | Consent must be free, specific, informed, unconditional and unambiguous, limited to the data needed, and withdrawable as easily as given | Purpose-specific consent records and a withdrawal route |
| DPDP Act 2023 s.8(5) and Schedule | Reasonable security safeguards to prevent personal data breaches; penalty up to 250 crore rupees | Encryption, access control and logging around e-KYC data and Aadhaar numbers |
The DPDP Act (No. 22 of 2023) received assent on 11 August 2023, and the Digital Personal Data Protection Rules, 2025 were reported as notified in November 2025 with staged implementation timelines; confirm which obligations are in force on the date you rely on this. Aadhaar Act offences in sections 40 and 41 apply to requesting entities. See the India DPDP Act Guide and India IT Act 2000 and SPDI Rules.
Security lessons
- A universal identifier is a universal join key: every database that stores Aadhaar numbers can be linked to every other. Store them only when the law requires it, encrypted and tokenised, in a separate vault with its own access control and logging.
- Exposure happens at the edges: scanned cards in shared drives, Aadhaar numbers in application logs, e-KYC responses cached in analytics tables and open storage buckets are the recurring patterns.
- The integration credentials are the keys to the kingdom: licence keys, signing certificates and API credentials that let your platform call the authentication service are non-human identities. Keep them in a secrets manager or HSM, scope them per environment and rotate them. See the Secrets Management Guide.
- Assisted channels need fraud controls: agents and business correspondents operating biometric devices can misuse captures or consent. Monitor per-operator volumes, failure rates and off-hours activity. See Top 10 KYC Bypass Techniques.
- OTP inherits telecom risk: SIM swap and OTP phishing defeat OTP-only flows; step up to biometric or multi-factor for high-value actions.
Common misconceptions
- "An Aadhaar card proves identity." A card or its image proves only that a card exists. Verification needs OTP or biometric authentication, or signature verification of offline e-KYC plus a check on the person.
- "Aadhaar proves citizenship." UIDAI says authentication does not confer or prove citizenship or domicile.
- "A successful authentication means we can keep the data." UIDAI rules limit use of identity information to submission for authentication, and DPDP limits retention to the stated purpose.
- "Masking the number is enough." Masking on screen does not help if the full number sits in logs, backups or analytics extracts; minimise collection and use the VID or offline e-KYC reference instead.
- "Aadhaar can be mandatory for any service." UIDAI requires alternate viable means of identification for people without Aadhaar, and private use is restricted; take legal advice before making it the only route.
Related concepts
- Identity assurance levels: Aadhaar does not publish levels in the NIST SP 800-63 sense; map OTP, biometric and multi-factor modes to your own assurance policy. See the NIST SP 800-63A-4 Identity Proofing (IAL) Guide.
- Biometric presentation attacks: spoofed fingerprints and faces against capture devices. See the Biometric Liveness and Presentation Attack Detection Guide.
- Verified claims over federation: standards such as OpenID Connect for Identity Assurance show how verified attributes can travel without raw identifiers. See the OpenID Connect for Identity Assurance Guide.
- Digital identity wallets: the EU approach of user-held credentials contrasts with Aadhaar's central verification. See the Digital Identity Wallets Guide.
Framework mapping and measures
| Activity | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| e-KYC onboarding and proofing | IA-12 Identity Proofing | PR.AA-02 |
| Authenticating customers at sign-in or transaction | IA-8 Identification and Authentication (Non-organizational Users) | PR.AA-03 |
| Protecting stored Aadhaar numbers and e-KYC data | SC-28 Protection of Information at Rest | PR.DS-01 |
Useful measures: count of systems holding full Aadhaar numbers (target: only the vault); percentage of authentications using VID or offline e-KYC; consent records present for 100% of authentications; e-KYC records past their retention date (target zero); per-operator anomaly alerts reviewed within one business day.
Practitioner checklist
- Inventory every system, log, bucket and file share that holds Aadhaar numbers, card images or e-KYC data, and remove what the law does not require.
- Choose the verification route by risk: OTP or biometric e-KYC for regulated onboarding, multi-factor for high-value actions, offline e-KYC where you do not need the number.
- Accept VIDs wherever you authenticate, and never accept a card image as verification.
- Show consent, purpose and the alternative route before every authentication, and record the consent.
- Verify the UIDAI signature on every offline e-KYC file and confirm the person by OTP or face match.
- Keep any stored Aadhaar numbers tokenised and encrypted in a dedicated vault with separate access control and logging.
- Store integration keys and certificates in a secrets manager or HSM, scope them per environment and rotate them.
- Monitor assisted-channel operators for abnormal volumes and failure rates.
- Map your obligations under the Aadhaar Act and the DPDP Act and Rules, and recheck commencement dates each quarter.
Standards and references
- UIDAI: Authentication ecosystem
- UIDAI: About Aadhaar Paperless Offline e-KYC
- UIDAI: Virtual ID (VID) FAQs
- MeitY: Digital Personal Data Protection Act, 2023
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: National Digital ID Schemes Map · India DPDP Act Guide · Identity Proofing and KYC Guide · Digital Identity Wallets Guide. This guide summarises the Aadhaar Act and related Indian data protection law and is not legal advice.