Aadhaar Act, 2016
The law that governs the Aadhaar identity number and its authentication.
The Aadhaar Act, 2016 is the separate law that sets up the Aadhaar number, decides who can ask for it and how it can be verified. It keeps applying alongside the DPDP Act, so anyone handling Aadhaar numbers has to follow both.
Meaning of Aadhaar Act, 2016
Use of Aadhaar authentication is regulated by the Aadhaar Act and UIDAI rules, which continue to apply alongside the DPDP Act. Organisations should collect Aadhaar numbers only where the law permits, and secure them well.
The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 created the Unique Identification Authority of India (UIDAI) and the 12-digit Aadhaar number. It lays out how residents enrol, what identity information is collected, how that information is verified through authentication, and which offences and penalties apply to misuse. It is a statute about one specific identity system, not a general privacy law.
The DPDP Act, 2023 sits on top of this. Section 38 says the DPDP Act is in addition to, and not in derogation of, other laws, and that where there is a conflict the DPDP Act prevails to the extent of the conflict. In practice the two work together: the Aadhaar Act decides whether and how an organisation may ask for Aadhaar authentication or an Aadhaar number, while the DPDP Act decides how the personal data you collect in that process must be noticed, consented to, secured, retained and erased.
Some points of the Aadhaar Act matter every day. Section 29 restricts the use of core biometric information (fingerprints and iris scans): it can be used only to generate an Aadhaar number and for authentication, and cannot be shared for any other purpose. Authentication requires the person's consent and a statement of what information will be shared and why. In its 2018 Aadhaar judgment the Supreme Court upheld the Act but struck down Section 57 to the extent that it let private companies demand authentication under contract. The 2019 amendment then allowed voluntary Aadhaar-based verification by entities that UIDAI permits under a law or a regulatory approval.
Do not confuse the Aadhaar number with Aadhaar-based authentication. Many organisations only see a number or a photocopy, which is a very different thing from running a biometric or OTP check with UIDAI. UIDAI has also promoted the Virtual ID and masked Aadhaar so that the full number need not be stored. Whichever route you use, the DPDP Act treats the Aadhaar number as personal data, and the Rules on security safeguards (Rule 6) apply to it as they do to any other personal data.
Examples of Aadhaar Act, 2016
A company that wants to use Aadhaar-based attendance checks whether the Aadhaar Act permits it before building the flow.
A residential society wants every resident's Aadhaar photocopy for its visitor register. Because no law requires this, the secretary switches to a society ID card and asks for an optional address proof, and shreds the copies already collected once the purpose has been checked.
A bank carries out Aadhaar-based e-KYC for account opening as its regulator permits. It takes explicit consent at the screen, tells the customer what will be fetched, stores only what KYC rules require, and secures the record under its DPDP safeguards.
A staffing agency collects Aadhaar cards from 800 temporary workers by email and WhatsApp. After an internal review, it moves collection to a secured portal with masked numbers, restricts access to two HR officers, and sets a deletion date for each worker's file.
Why Aadhaar Act, 2016 matters
Mishandling Aadhaar attracts two layers of consequences. Under the Aadhaar Act, unauthorised disclosure, impersonation and misuse of identity information are offences with imprisonment and fines, and UIDAI can act against requesting entities that break its rules. Under the DPDP Act, a failure to keep reasonable security safeguards over Aadhaar data can lead to a penalty of up to ₹250 crore after an inquiry by the Data Protection Board, and a failure to report a breach carries up to ₹200 crore.
The commercial risk is just as real. An Aadhaar number lets someone open accounts, take SIM cards or apply for loans, so a leak of Aadhaar photocopies from a shop, a hotel or a coaching centre can hurt individuals badly, and the organisation takes the reputational damage. Organisations that ask for Aadhaar only because "everyone does" often cannot name a legal basis for it, which is exactly the weakness a complainant or the Board will examine.
How it works in practice
- 1Start with a purpose test. For every form, app screen or counter where Aadhaar is requested, write down the law, regulator direction or UIDAI permission that allows it. If you cannot find one, ask for another identity document or make the Aadhaar number optional.
- 2Prefer the lightest option. Where a verification service permits it, use masked Aadhaar, a Virtual ID or an offline verification method instead of storing the full number. Never keep a copy "just in case" once the check is done.
- 3Keep authentication and storage apart. If your organisation is a requesting entity under UIDAI's framework, follow its security and audit conditions, keep biometric capture on approved devices, and never store core biometric information on your own systems unless the framework expressly allows it.
- 4Write the notice plainly. Under Section 5 and Rule 3 the notice should say that Aadhaar is being collected, for which purpose, and what happens if the person declines. Do not tie an unrelated service to Aadhaar submission.
- 5Secure what you hold. Apply encryption or masking, restrict access to named staff, log access, and delete Aadhaar copies when the stated purpose is over, unless a sector law such as KYC rules requires you to retain them.
- 6Train front-desk staff. Many leaks happen when receptionists, agents or couriers photocopy and keep Aadhaar cards in drawers or on shared phones.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Assuming the DPDP Act replaces Aadhaar rules. It does not; both apply, and where they conflict the DPDP Act prevails to that extent. Check each law for its own conditions.
Treating a photocopy of the Aadhaar card as harmless. A photocopy carries the full number, photo and address, so it must be secured and deleted like any other high-value personal data.
Making Aadhaar compulsory for a service that does not legally need it. Private entities cannot demand authentication on contract terms alone, so offer another identity document.
Storing fingerprints or iris data captured for Aadhaar checks in your own database. Core biometric information may be used only for the purposes the Aadhaar Act allows.
Compliance tips
Keep an Aadhaar register of every place the number is collected, the legal basis and the retention period. Review it every six months.
Replace stored full numbers with masked numbers or tokens wherever the business process allows.
If a vendor handles Aadhaar for you, sign a processor contract that covers security, breach reporting and deletion, as Section 8(1) holds you responsible for your processor.
Plan your deletion before the DPDP duties start on 13 May 2027, so that old Aadhaar copies are cleaned up instead of becoming a liability.
Common questions about Aadhaar Act, 2016
Does the DPDP Act replace the Aadhaar Act?
No. The Aadhaar Act continues as a separate law on how Aadhaar is issued, authenticated and protected. The DPDP Act adds general duties on notice, consent, security and erasure for the personal data involved. Under Section 38, if the two conflict, the DPDP Act prevails only to the extent of that conflict.
Can a private company ask for my Aadhaar number?
Only where a law or a regulator permits it, for example KYC under financial rules. After the Supreme Court's 2018 judgment, a private company cannot insist on Aadhaar authentication on the strength of a contract alone. If it asks, you can ask which law requires it.
Is Aadhaar "sensitive" under the DPDP Act?
The DPDP Act has no sensitive category, so the Aadhaar number is simply personal data. But the risk is high, and Rule 6 safeguards, the penalty of up to ₹250 crore for security failures and the Aadhaar Act's own offences make careful handling essential.
Can I keep Aadhaar copies after verifying someone?
Only if a law requires it or you still need them for the stated purpose. Section 8(7) requires erasure once the purpose is served, unless the law requires retention. A convenience copy "for later" usually fails that test.