Legal Identity

There is no one officially recognised legal identity document in India, and citizenship is conferred through descent.^[1]In India, National Family Health Surveys indicate that until 2016, 20% of children — approximately 5 million — did not have access to birth certificates; more than half were not registered at all, and the other half, while registered, did not have access to their registration.^[2]Birth registration is a foundational identity document in India to establish age and nationality, and is required to access other identity documents such as passports, to enroll in schools, and to cast a vote upon attaining majority, among others.^[3]

Digital ID Overview

‘Aadhaar’, introduced in 2009 as India’s digital ID, aims to provide a unique, universally accepted identifier where each individual’s unique identity (i.e., their Aadhaar number) is verified against the demographic and biometric data stored in a centralized database known as the Central Identities Data Repository (“CIDR”).^[4]To obtain an Aadhar, there are specific requirements of documentation necessary, which require individuals to any one provide proof of identity (passport, PAN number, Voter identification number, etc.) any one proof of relationship (PDS Card, MNREGA Job Card, Government issued Marriage Certificate, etc.), one proof of birth (birth certificate, passport, photo ID card having the date of birth, recognised by educational institutions, etc.), and one proof of residence (passbook, bank statements, electricity bill, ration card, etc.).^[5]It is interesting to note here that while Aadhar does not constitute a foundational legal identity document, its adoption has achieved near universal status in the country, where birth registration still lags behind.^[6]

In the context of India, Aadhaar was conceived as a foundational ID ^[7]to address the problem of identifying individuals in a country as large and diverse as India. Its primary purpose was to eliminate duplication and ensure that each resident has a unique identity, which could be used for a wide range of services and entitlements provided by the State.^[8]

However, a policy shift saw the adoption of digital IDs as a mode of functional ID with the main purpose of streamlining the delivery process of social inclusion projects managed by the Government of India. The main objective of these policies was to fill the identity gap that exists in case of implementation of digital initiatives of the government, which in turn, is also one of the sustainable development goals as suggested by the United Nations, i.e., the right to identity.^[9]Therefore, the Aadhaar framework sought to develop a system that guaranteed social protection by preventing leakages and mismanagement in welfare schemes, and “provide efficient, transparent and targeted delivery of subsidies, benefits and services, to the residents of India”.^[10] ^[11]

Legally, the Aadhar is not a mandatory ID for individuals to possess.^[12]However, practically, access to almost any government service requires the possession of an Aadhar, both in law and practice. The Supreme Court, in the Aadhaar 5 Judge Case acknowledged the risks of exclusion and ruled that Aadhaar could not be mandatory for accessing welfare benefits. While upholding the Aadhar’s constitutionality, the Apex Court emphasized that an individual cannot be deprived of essential services due to the failure of biometric identification.^[13]The judgment underscored the need to balance Aadhaar’s benefits with the protection of marginalized groups from being excluded from crucial resources.^[14]

Aadhar has since then expanded to cover various aspects of an individual’s interaction with the State. These include access to subsidies, financial services, and welfare programs, reinforcing its role as a functional ID system, making it mandatory to possess.^[15]Aadhaar has also been directly linked for accessing various public services being provided by the Government. For instance, it has been linked with the direct benefit transfer scheme so that individuals can receive benefits for PDS system, MNREGA etc. directly in its bank account,^[16]Aadhaar enabled payment systems have been enabled to ensure digital transactions through Aadhar details.^[17]It is also a mandated document for SIM Cards as well as to access government mandated healthcare services.^[18]The legal framework surrounding Aadhaar and subsequent judicial rulings, underscores its functional nature, particularly in the context of the State’s obligation to recognize and verify the identity of its residents for various public services.^[19]The Preamble of the Aadhaar Act clarifies that the Aadhaar ID is being developed as a unique ID for the efficient, transparent and targeted delivery of public services, subsidies, benefits, etc. being provided by the Government.^[20]

According to Section 7 of the Aadhaar Act, individuals without an Aadhaar number can still receive benefits, subsidies, and services through alternative means of identification.^[21]However, in August 2022, the Government through a circular stated that Aadhaar is required for accessing government benefits.^[22]The circular noted that over 99% of adults in India now have an Aadhaar number.^[23]Therefore, individuals without Aadhaar must apply for enrollment and can use their Aadhaar Enrolment Identification number or slip to access benefits and services until they receive their Aadhaar number.^[24]In terms of stateless individuals, those who do not hold appropriate residency status (Long-Term Visas), are automatically ineligible to apply for Aadhar, excluding them from accessing various government services as discussed below, with no alternate avenues to access the same.^[25]

The Aadhaar Act expressly states that it does not confer any proof of citizenship or domicile on the Aadhaar number holder.^[26]Since January 2024, new Aadhaar cards and PDF versions of the identity document have started including an express disclaimer on Aadhaar not being a proof of identity, as well as, date of birth to government departments and other organizations to not use it for those purposes.^[27]The Aadhaar (Enrolment and Update) Regulations 2016, allow for foreign nationals that have stayed in India for more than 182 days to get enrolled and obtain an Aadhaar number, as long as they qualify as a ‘resident’ as per the Aadhaar Act.^[28]The implementation of Aadhaar has had exclusionary consequences, particularly for stateless communities who often lack foundational documents such as birth certificates that are required to obtain an Aadhaar number.^[29]Without it, individuals are effectively barred from accessing essential services and social welfare schemes. Documented evidence also highlights how structural issues within the Aadhaar system such as biometric authentication failures, faulty equipment, and unreliable internet connectivity have led to people being denied access to food and entitlements, further marginalizing already vulnerable populations.^[30]Refugees and stateless people have no avenue to obtain an Aadhar, since the Ministry of Home Affairs in 2018 made a distinction between “refugees” and “legal residents”, claiming that Aadhar would be available to those who were “legal residents”.^[31]Furthermore, the government stopped accepting the UNHCR-cards, thereby removing all possible pathways for individuals to access social services or a possibility to acquire Long-Term Visas.^[32] Similarly, exclusions from basic services have been faced by individuals left out of Assam’s National Register of Citizens (NRC) as they are unable to access Aadhaar enrollment.^[33]These exclusions severely restrict access to essential services, benefits, and legal recognition of individuals impacted by statelessness.^[34]

Law

Domestic law and policy

The digital ID system is governed by the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 (‘Aadhaar Act’) states that Aadhaar was established to enhance the delivery of central or state government subsidies, benefits, and services to individuals residing in India by assigning to individuals such unique ID numbers.^[35]Presently, India does not have a uniform definition of ‘digital identity’ in its legal framework, or by virtue of being a signatory to any international instrument. However, in practice, digital identity in the Indian context refers to the electronic representation of an individual’s identity, which can be used to authenticate and verify the individual’s identity online or in digital transactions.^[36]

Aadhar does not constitute proof of citizenship in India. Section 9 of the Aadhaar Act expressly states that it does not confer any proof of citizenship or domicile on the Aadhaar number holder.^[37]This is complemented by the Aadhaar (Enrolment and Update) Regulations 2016, which allow foreign nationals that have stayed in India for more than 182 days to get enrolled and obtain an Aadhaar number.^[38]Further, as of January 2024, new Aadhaar cards and PDF versions of the identity document have started including an express disclaimer on Aadhaar not being a proof of identity, as well as, date of birth to government departments and other organizations to not use it for those purposes. However, there is explicit linkage of citizenship with Aadhar, as observed in Assam, where around 1 million people faced blocked IDs on the pretext of “precarious citizenship status” during the NRC Process.^[39]This precarity was not a judicial mandate, but rather an administrative exercise adjudicating the most important human right of all– nationality. The blocking of these ID’s on executive authority, resulted in individuals living their lives in limbo for five years, without any means to their entitled government benefits, access to healthcare, and faced challenges in obtaining salaries from employers.^[40]

Data Protection

The implementation of Aadhar came much prior to a legislation on data protection or privacy, which are amiss in law even today. Six years after the Supreme Court of India granted the right to privacy as a fundamental right, the law on Digital Personal Data Protection Act (‘DPDP Act’) came into force in 2023 ^[41]with the Digital Personal Data Protection Rules, 2025 (‘Draft Rules’) being released in January 2025. The Ministry of Electronics and Information Technology has opened it up for comments from various stakeholders and the DPDP Act is currently in the final stages of enforcement.^[42]The regulations on privacy are currently governed by the Information and Technology Act, 2000 and Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.^[43]These rules in addition to the specific protections under the Aadhaar Act are applied to biometric data.

The right to privacy, while being a fundamental right as laid down by the Supreme Court, is not an absolute right. The Apex Court laid down a three-fold test to be satisfied in case an individual’s right to privacy is being impinged upon: (i) ‘legality’, i.e., the action must be sanctioned by law; (ii) ‘necessity’, i.e., the proposed action must be necessary in a democratic society for pursuing legitimate aims of Governmental agencies; and (iii) ‘proportionality’, i.e., the extent of such interference by the legislative action must be proportionate to the need for interference; and there should be a rational nexus between a Government’s objective and the means adopted to achieve such objective.^[44]This means the Indian government may be able to access Aadhaar data if it meets the above criteria. However, if the government accesses data unlawfully or without due process, individuals can challenge this infringement on their fundamental right to privacy. Further, given that Article 21 of the Constitution extends to “every person”,^[45]the right to privacy is available to non-citizens / foreign nationals, in addition to Indian citizens. Critics argue that the provisions of the Draft Rules are not only in violation of Constitutional principles of data protection, but are also seen to disregard the proportionality test laid down in the Aadhar 5-judge case.^[46]Under Rule 22, the Executive is given broad access to personal information with no transparency in terms of the number of times that the government can access the information, “undermining principles of purpose limitation and data minimisation”.^[47]This centralised framework with unfettered access to personal information creates grounds for state surveillance. Furthermore, the Draft Rules, while they require an independent regulatory body such as the Data Protection Board to oversee compliance, there are concerns raised with regards to the political influence, due to the appointments to the Board being undertaken by the Executive.^[48]Finally, the Draft Rules also weaken the Right to Information Act, which guarantees the fundamental right to information. It allows officials to withhold personal information that may be critical to public interest under the garb of the right to privacy, departing from the standard of proportionality laid down by the Puttaswamy judgment.^[49]

There have been repeated instances where the personal data collected for Aadhaar, which include names, addresses, dates of birth, and Aadhaar numbers, have been inadvertently exposed or accessed through unauthorized means.^[50]This is despite the fact that the core databases maintained by the Unique Identification Authority of India (UIDAI) have not suffered confirmed breaches.^[51]In one widely reported case from 2018, a journalist was able to pay just INR 500 (around USD 7) to gain access to a portal that allowed them to input any Aadhaar number and retrieve the corresponding demographic information.^[52]This incident has highlighted the ease with which sensitive data can be obtained, and points to larger systemic issues, particularly the ambiguity surrounding who can access such data, how it is to be managed, and under what safeguards.

In July 2025, the Government of India during the state elections of Bihar introduced the E-SECBHR mobile application to cast votes.^[53]However, the development and implementation of this scheme has been undertaken without any clearly defined legal framework, parliamentary discussion, or any public consultations that would ensure transparency and accountability.^[54]Civil society has raised serious concerns on the transparency of how the data collected, which includes facial recognition and other biometrics data, is stored, used, and shared. Furthermore, the procedure of casting a vote, requires the identity of an individual to be authenticated by the application by sharing an OTP against a mobile number, where two people are allowed to cast a vote from the same confines of their homes. They have also flagged the ominously low rates of digital literacy in Bihar, with around 67% women and 35.4% men who have never used the internet.^[55]This lack of digital literacy amplifies the risk of voter coercion, where there is little guarantee of the vote being cast in a fully informed manner, without coercion.^[56]The Internet Freedom Foundation notes that the privacy policy of the E-SECBHR allowed for data sharing with third parties, reserving the right to use the data for research and analysis purposes.^[57]

International Commitments

India is not a party to any international framework, agreement or treaty which sets out obligations in relation to or definition for a digital ID. However, India, being a member of the United Nations, has made a non-binding commitment through the 2030 Agenda on Sustainable Development with respect to providing legal identity to all, as part of Goal 16 of the Sustainable Development Goals (“SDG”).^[58] .India is also not a party to any international agreements on data protection that specifically regulates their practice for implementation of framework on digital IDs. However, the country’s approach to data protection is influenced by its constitutional framework and obligations to other international human rights instruments, which upholds the rule of law and fundamental human rights, including the right to privacy. Furthermore, the Constitution of India guarantees fundamental rights such as the protection of life and personal liberty, freedom of speech, and protection against discrimination.^[59] .Furthermore, India is a signatory and party to several core international human rights instruments, including the United Nations Declaration of Human Rights (“UDHR”), the International Covenant on Civil and Political Rights (“ICCPR”), the International Covenant on Economic, Social and Cultural Rights (“ICESCR”), the Convention on the Rights of the Child (“CRC”), and the Convention on the Elimination of All Forms of Discrimination Against Women (“CEDAW”). These instruments emphasize the protection of privacy and non-discrimination, which align with India’s constitutional values. For instance, Article 12 of the UDHR, and Article 17 of ICCPR are similar, as they require that no individual shall be subjected to “arbitrary interference with regard to his privacy, family, home, or correspondence, nor to attacks upon his honor and reputation and everyone has the right to protection of the law against such interference or attacks”.^[60]The ICESCR guarantees certain fundamental human rights, such as right to education,^[61]right to be free “from discrimination of any kind as to race, color, sex, language, religion, political or other opinion, national or social origin, birth or other status”.^[62]Further, the CEDAW prohibits discrimination against women in all forms and embodies the principle of equality of men and women, and the CRC directs all parties to the convention to take appropriate measures to ensure that the child is protected against all forms of discrimination, including from discrimination towards the child because of their or their parent’s national , ethical, and social origins.^[63]The CRC also lays an obligation on State Parties to register children right after birth, where the child has the right to acquire a nationality.^[64]

Designed to Include?

The Impact of Digital ID and Legal Identity on Citizenship and Nationality Rights

Despite the government’s push for “Digital India”^[65]and the reliance on Aadhaar to reduce leakages, the system has been riddled with problems of exclusion that are not just limited to stateless individuals, but citizens and residents too. Research pointedly states that the system has been devoid of multiple technical and logistical vulnerabilities that has ultimately blocked eligible individuals from receiving and accessing essential services.^[66]In several states, it was found that individuals were required to provide fingerprint scans to collect food ration.^[67]A survey conducted across three states revealed that Aadhaar-related issues accounted for 0.8 to 2.2 percent of all exclusions from the PDS, leading to a denial of food rations to over 2 million people.^[68]These failures reportedly stemmed from a range of factors, including the absence of Aadhaar linkage, biometric mismatches, connectivity problems, electricity outages, or simply the beneficiary being unable to physically authenticate at the time of distribution.^[69]Furthermore, the advancement of technology has resulted in the deepening of the exclusionary mandate of Aadhar due to the lack of regulatory safeguards and legislative frameworks. In terms of data protection, the country has witnessed almost a breakdown of due process, where data, while maybe with the intent of ensuring inclusion has come at a cost of ensuring “privacy, security, and democratic legitimacy”.^[70]The absence of strong regulatory safeguards, inadequate infrastructure, and limited avenues for redress have turned what should be enabling systems into barriers, resulting in disempowering the vulnerable. Without meaningful legal protections, transparency, and accountability mechanisms in place, the promise of “Digital India” may continue to leave behind those it claims to empower.