Domestic law and policy
The digital ID system is governed by the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 (‘Aadhaar Act’) states that Aadhaar was established to enhance the delivery of central or state government subsidies, benefits, and services to individuals residing in India by assigning to individuals such unique ID numbers.[35]Presently, India does not have a uniform definition of ‘digital identity’ in its legal framework, or by virtue of being a signatory to any international instrument. However, in practice, digital identity in the Indian context refers to the electronic representation of an individual’s identity, which can be used to authenticate and verify the individual’s identity online or in digital transactions.[36]
Aadhar does not constitute proof of citizenship in India. Section 9 of the Aadhaar Act expressly states that it does not confer any proof of citizenship or domicile on the Aadhaar number holder.[37]This is complemented by the Aadhaar (Enrolment and Update) Regulations 2016, which allow foreign nationals that have stayed in India for more than 182 days to get enrolled and obtain an Aadhaar number.[38]Further, as of January 2024, new Aadhaar cards and PDF versions of the identity document have started including an express disclaimer on Aadhaar not being a proof of identity, as well as, date of birth to government departments and other organizations to not use it for those purposes. However, there is explicit linkage of citizenship with Aadhar, as observed in Assam, where around 1 million people faced blocked IDs on the pretext of “precarious citizenship status” during the NRC Process.[39]This precarity was not a judicial mandate, but rather an administrative exercise adjudicating the most important human right of all– nationality. The blocking of these ID’s on executive authority, resulted in individuals living their lives in limbo for five years, without any means to their entitled government benefits, access to healthcare, and faced challenges in obtaining salaries from employers.[40]
Data Protection
The implementation of Aadhar came much prior to a legislation on data protection or privacy, which are amiss in law even today. Six years after the Supreme Court of India granted the right to privacy as a fundamental right, the law on Digital Personal Data Protection Act (‘DPDP Act’) came into force in 2023 [41]with the Digital Personal Data Protection Rules, 2025 (‘Draft Rules’) being released in January 2025. The Ministry of Electronics and Information Technology has opened it up for comments from various stakeholders and the DPDP Act is currently in the final stages of enforcement.[42]The regulations on privacy are currently governed by the Information and Technology Act, 2000 and Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.[43]These rules in addition to the specific protections under the Aadhaar Act are applied to biometric data.
The right to privacy, while being a fundamental right as laid down by the Supreme Court, is not an absolute right. The Apex Court laid down a three-fold test to be satisfied in case an individual’s right to privacy is being impinged upon: (i) ‘legality’, i.e., the action must be sanctioned by law; (ii) ‘necessity’, i.e., the proposed action must be necessary in a democratic society for pursuing legitimate aims of Governmental agencies; and (iii) ‘proportionality’, i.e., the extent of such interference by the legislative action must be proportionate to the need for interference; and there should be a rational nexus between a Government’s objective and the means adopted to achieve such objective.[44]This means the Indian government may be able to access Aadhaar data if it meets the above criteria. However, if the government accesses data unlawfully or without due process, individuals can challenge this infringement on their fundamental right to privacy. Further, given that Article 21 of the Constitution extends to “every person”,[45]the right to privacy is available to non-citizens / foreign nationals, in addition to Indian citizens. Critics argue that the provisions of the Draft Rules are not only in violation of Constitutional principles of data protection, but are also seen to disregard the proportionality test laid down in the Aadhar 5-judge case.[46]Under Rule 22, the Executive is given broad access to personal information with no transparency in terms of the number of times that the government can access the information, “undermining principles of purpose limitation and data minimisation”.[47]This centralised framework with unfettered access to personal information creates grounds for state surveillance. Furthermore, the Draft Rules, while they require an independent regulatory body such as the Data Protection Board to oversee compliance, there are concerns raised with regards to the political influence, due to the appointments to the Board being undertaken by the Executive.[48]Finally, the Draft Rules also weaken the Right to Information Act, which guarantees the fundamental right to information. It allows officials to withhold personal information that may be critical to public interest under the garb of the right to privacy, departing from the standard of proportionality laid down by the Puttaswamy judgment.[49]
There have been repeated instances where the personal data collected for Aadhaar, which include names, addresses, dates of birth, and Aadhaar numbers, have been inadvertently exposed or accessed through unauthorized means.[50]This is despite the fact that the core databases maintained by the Unique Identification Authority of India (UIDAI) have not suffered confirmed breaches.[51]In one widely reported case from 2018, a journalist was able to pay just INR 500 (around USD 7) to gain access to a portal that allowed them to input any Aadhaar number and retrieve the corresponding demographic information.[52]This incident has highlighted the ease with which sensitive data can be obtained, and points to larger systemic issues, particularly the ambiguity surrounding who can access such data, how it is to be managed, and under what safeguards.
In July 2025, the Government of India during the state elections of Bihar introduced the E-SECBHR mobile application to cast votes.[53]However, the development and implementation of this scheme has been undertaken without any clearly defined legal framework, parliamentary discussion, or any public consultations that would ensure transparency and accountability.[54]Civil society has raised serious concerns on the transparency of how the data collected, which includes facial recognition and other biometrics data, is stored, used, and shared. Furthermore, the procedure of casting a vote, requires the identity of an individual to be authenticated by the application by sharing an OTP against a mobile number, where two people are allowed to cast a vote from the same confines of their homes. They have also flagged the ominously low rates of digital literacy in Bihar, with around 67% women and 35.4% men who have never used the internet.[55]This lack of digital literacy amplifies the risk of voter coercion, where there is little guarantee of the vote being cast in a fully informed manner, without coercion.[56]The Internet Freedom Foundation notes that the privacy policy of the E-SECBHR allowed for data sharing with third parties, reserving the right to use the data for research and analysis purposes.[57]
International Commitments
India is not a party to any international framework, agreement or treaty which sets out obligations in relation to or definition for a digital ID. However, India, being a member of the United Nations, has made a non-binding commitment through the 2030 Agenda on Sustainable Development with respect to providing legal identity to all, as part of Goal 16 of the Sustainable Development Goals (“SDG”).[58] .India is also not a party to any international agreements on data protection that specifically regulates their practice for implementation of framework on digital IDs. However, the country’s approach to data protection is influenced by its constitutional framework and obligations to other international human rights instruments, which upholds the rule of law and fundamental human rights, including the right to privacy. Furthermore, the Constitution of India guarantees fundamental rights such as the protection of life and personal liberty, freedom of speech, and protection against discrimination.[59] .Furthermore, India is a signatory and party to several core international human rights instruments, including the United Nations Declaration of Human Rights (“UDHR”), the International Covenant on Civil and Political Rights (“ICCPR”), the International Covenant on Economic, Social and Cultural Rights (“ICESCR”), the Convention on the Rights of the Child (“CRC”), and the Convention on the Elimination of All Forms of Discrimination Against Women (“CEDAW”). These instruments emphasize the protection of privacy and non-discrimination, which align with India’s constitutional values. For instance, Article 12 of the UDHR, and Article 17 of ICCPR are similar, as they require that no individual shall be subjected to “arbitrary interference with regard to his privacy, family, home, or correspondence, nor to attacks upon his honor and reputation and everyone has the right to protection of the law against such interference or attacks”.[60]The ICESCR guarantees certain fundamental human rights, such as right to education,[61]right to be free “from discrimination of any kind as to race, color, sex, language, religion, political or other opinion, national or social origin, birth or other status”.[62]Further, the CEDAW prohibits discrimination against women in all forms and embodies the principle of equality of men and women, and the CRC directs all parties to the convention to take appropriate measures to ensure that the child is protected against all forms of discrimination, including from discrimination towards the child because of their or their parent’s national , ethical, and social origins.[63]The CRC also lays an obligation on State Parties to register children right after birth, where the child has the right to acquire a nationality.[64]
