UIDAI: The Aadhaar of Identity

Different Truths serialises JAMMAI that focuses on the development in India. An initiative of the present government, it’s an ambitious project. We hope that the blueprint on paper matches the political will of the Modi government. Here’s the second part of the six-part article. Anirban reports on the need for national identification number for the largest democracy of the world.

Let’s take up the second topic in JAMMAI series, the Unique Identification Authority of India (UIDAI) and elaborate on it.

The Unique Identification Authority of India (UIDAI) is a central government agency of India. It is attached to the erstwhile Planning Commission of India, now NITI Aayog. Its objective is to gather the biometric and demographic data of residents, store them in a centralised database, and issue a 12-digit unique identity number called Aadhaar to each of the residents. It is actually the world’s largest national identification number project. As of 31 December 2015, over 95 crore (950 million) Aadhaar numbers have been issued in the project. Its main uses are Direct Benefit Transfer (DBT), Aadhaar-Enabled Biometric Systems, and linkages to central and other states for a national security database.

Unique identification project was initially conceived by the Planning Commission as a work that would provide identification for each resident across the country and would be used primarily as the basis for efficient delivery of welfare services. It would also act as a tool for effective monitoring of various programs and schemes of the Government of India.

The Aadhaar Card has a 12-digit unique identification number and it is used to apply for various government schemes. The UID card could help the person in case if they do not have their ID proof. Whenever you are asked to provide the identity proof by the government then this UID could be easily used. This card is helpful for those people who don’t know their birth date as the card do not rely on any compulsion of providing the birth date information. If you would provide with any false information then the penalty would be charged.

Here are a few points on the Aadhaar Card that is important to note. The points are on governance, purpose, applicability, storage, use, verification, implementation, enrollment, and other criteria.

Aadhaar was constituted under the Planning Commission: The UIDAI was constituted as an attached office under the Planning Commission, in 2009. A Unique Identification Authority Bill had been drafted, but was not enacted. Though portions of the Information Technology Act 2008 apply to the UID scheme, Section 43A and Associated Rules (India’s data protection standards) do not clearly apply to the UIDAI as the provision has jurisdiction only over body corporate.

Aadhaar was created as a biometric based authenticator and a single unique proof of identity: The Aadhaar number was established as a single proof of identity and address for residents in India that can be used to authenticate the identity of an individual in transactions with organisations that have adopted the number. The scheme has been promoted as a tool for reducing fraud in the public distribution system and enabling the government to better deliver public benefits.

Aadhaar is for residents: The Aadhar number is available to any resident of India.

Storage, Access and Disclosure
Aadhaar and data generated at multiple sources is stored in the CIDR and processed in the data warehouse: According to the report, ‘Analytics, Empowering Operations’, “At UIDAI, data generated at multiple sources would typically come to the CIDR (Central ID Repository), UIDAIs Data centre, through an online mechanism. There could be certain exceptional sources, like Contact centre or Resident consumer surveys, which will not feed into the Data center directly. Data is then processed in the data warehouse using Business Intelligence tools and converted into forms that can be accessed and shared easily.” Examples of data that is stored in the CIDR include enrollments, letter delivery, authentication, processing, resident survey, training, and data from contact centres. It is unclear if organizations that authenticate individuals via the Aadhar number stores the number at the organisational level. Biometrics are listed as a form of sensitive personal information in the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) 2011, thus if anybody corporate collects biometrics with the Aadhaar number – the storage, access, and disclosure of this information would be protected as per the Rules, but the Aadhaar number is not explicitly protected.

Use by Public and Private Entities
Public and private entities can request Aadhaar: The Aadhaar number can be adopted by any public or private entity as a single means of identifying an individual. The UIDAI has stated that the Aadhaar number is not mandatory, and the Supreme Court of India has clarified that services cannot be denied on the grounds that an individual does not have an Aadhaar number.

The Aadhaar number can be verified in any transaction: If an organisation, department, or platform has adopted the Aadhaar number as a form of authentication, they can send requests for verification to the UIDAI. The UIDAI will respond with a yes or no answer. When using their Aadhaar number as a form of authentication individuals can submit their number and demographic information or their number and biometrics for verification.

Lost or Stolen
Aadhaar number may be replaced: If an individual has lost their Aadhaar number, there is a process that they may follow to have their number re-sent to them. If the number cannot be located by the UIDAI, the individual has the option of re-enrolling for a new Aadhaar number. The UIDAI has built the scheme with the understanding the biometrics are a unique identifier that cannot be lost or stolen, and thus have not created a system to address the possibility of stolen or fraudulent use of biometrics.

Bill and pilot studies: The UID scheme haas been envisioned as being brought into existence via the Unique Identification Authority Bill, 2010, which has not been passed. Thus far, the project has been implemented in pilot phases across states and platforms.

UIDAI, registrars, and enrolling agencies: The UIDAI is the only body that issues Aadhar numbers. Registrars (contracted bodies under the UIDAI – and enrolling agencies (contracted bodies under Registrars) are responsible for receiving and processing enrollments into the UID scheme.

Required Supporting Documents
Aadhaar requires proof of age, address, birth, and residence and biometric information: The application form requires the following information:
• Name
• Date of birth
• Gender
• Address
• Parent/guardian details
• Email
• Mobile number
• Indication of consenting or not consenting to the sharing of information provided to the UIDAI with Public services including welfare services
• Indication of if the individual wants the UIDAI to facilitate the opening of a bank account linked to the Aadhaar number and permits the sharing of information for this purpose
• If the individual has no objection to linking their present bank account to the Aadhar number and the relevant bank details
• Signature


The UID (Unique Identification) and NPR (National Population Register) are both government identity schemes that collect personal data, including biometric data for the provision of an identification factor, and aim to connect them with the delivery of public utility services. The differences between the two exist in terms of collection of data, the type of identification factor issued, authorities involved and the outcome achieved.

Despite the differences, there has been talk of combining the two schemes because of the overlap. In the same breath, it has been argued that the two schemes are incompatible. One of the UIDAI’s (Unique Identification Authority of India) functions is to harmonise the two schemes. As it stands, the schemes are distinct. Enrollment for a UID does not lead to automatic enrollment in the NPR. The NPR website expressly states that even if a data subject has undergone census or has been granted a UID Number, it is necessary to visit a data collection centre to provide biometric data for the NPR.

UID and NPR: The Differences
The basis of identity/ Unit of survey (Difficulty Inserting Appropriate Term): The most striking difference between the UID and NPR Schemes is their notion of identity. The UID is individual based, whereas the NPR scheme focuses on the household or the family as a composite unit. Thus, the UID seeks to register individuals, while the NPR seeks to gather data of the members of a household or family as a composite unit during the census and later register each person for an NPR Card, on the basis of the census data. To this extent, analysis of the data gathered from the two schemes will be different and will require differing analytical tools. The definition of the data subject and the population is different. In one scheme, the unit is an individual; in the other it is the household/family. Though the family is the composite unit in the NPR, the data is finally extracted and it is unpaired to provide individuals NPR cards, but the family based association is not lost and it is argued that this household association of NPR should be used to calculate and provide subsidies. Some states have put on hold transfer of cooking gas subsidy, which is calculated for each household, through Aadhaar-linked bank accounts. If both schemes were merged, the basis for determining entitlement to subsidies would be non-uniform.

Differences in information collection: The UID and NPR have different procedures for collection of information. In the UID scheme, all data is collected in data collection centers, whereas NPR data is collected door to door, in part, and in collection centers, for the other part. UID data is collected by the UIDAI themselves or by private parties, under contract. These contractors are private parties: often, online marketing service providers. The data subjects were initially allowed registration through an introducer and without any documentation. This was replaced with the verification system where documents were to be produced for registration for UID.

The NPR involves a dual collection process: The first stage is the door-to-door collection of data as part of the Census. This information is collected through questionnaire. No supporting documents/ proof are produced to verify this data. The verification happens at a later stage, through public display of the information. This data is digitised. The data subjects are then to give their biometric data at the data collection centers, on the production of the census slip. The biometric data collectors are parties who are empanelled by the UIDAI and are eligible to collect data under the UID Scheme. A subject’s data is aggregated and then re-duplicated by the UIDAI.

It shows two points of merger: It may be suggested that when data is collected for the UID number, then the subject might not give their biometrics for the NPR Scheme again. The sharing of biometrics across the schemes will reduce cost and redundancy. While sharing of UID data with NPR is feasible, the reverse is not true, since UID is optional and NPR is not. If NPR data is to be shared with UID, then the subject has the right to refuse. However, the consent for using NPR data for the UID is a default YES in the UID form. Prohibiting the information sharing is no option.

Differences in stated purposes: The NPR is linked to citizenship status. The NPR exercise is being conducted to create a national citizen register and to assist in identifying and preventing illegal immigration. The NPR card, a desired outcome, is aimed to be a conduit for transactions relating to subsidies and public utilities. So is the UID Number, which was created to provide the residents of India an identity. The linkage and provision of subsidies through the NPR and UID cards have not taken off on a large scale and there is a debate as to which will be more appropriate for direct benefit transfer, with some leaders proclaiming that the NPR scheme is more suited to direct benefit transfer. Since the UID Number is linked to direct benefit transfer, but not to citizenship, benefits such as those under the MNREGA scheme, may be availed by non-citizens as well, though only citizens are eligible for the scheme.

C. Chandramouli, the Registrar General and Census Commissioner of India, states that the conflict between the two schemes is only perceived, and results from a poor understanding of the differences in objective. The NPR, he states is created to provide national security through the creation of a citizen register, starting with a register of residents after authentication and verification of the residence of the subjects. On the other hand, the UID exercise is to provide a number that will be used to correctly identify a person.

Difference in legal sanctity: The UIDAI was set up through an executive notification, which dictates a few of its responsibility, including: assigning a UID number, collating the UID and NPR schemes, laying down standards for interlinking with partner databases and so on. However, the UIDAI has not expressed responsibility to collect, or authorise collection of data under this scheme. The power to authorize the collection of biometrics is vested with the National Identification Authority of India (NIAI), which will be set up under the National Identification Authority of India Bill, (NIAI Bill, which is at times referred to as the UID Bill).

The NPR Scheme has been created pursuant to the 2004 Amendment of the Citizenship Act. Under Sec. 14A of the Citizenship Act, the central government has the power to compulsorily register citizens for an Identity Card. This gives the NPR exercise sanctity. However, no authority to collect biometric information has been given either under this Act or Rules framed under it.

Future of Aadhaar

The existence of both the UID and NPR Schemes leads to redundancy. Therefore, many have advocated for their merger. This seems impractical, as the standards in collection and management of data are not the same.
For some time, it was thought that the Aadhaar Scheme would be scrapped. This belief was based on the present government’s opposition to the scheme during and before the election. This was further strengthened by the fact that they did not expressly mention the continuance of the scheme in their manifesto. The Cabinet Committee on UIDAI was disbanded and the enrollment for the UID Number was stopped, only to be resumed, a short while later.
However, recent events show that the Aadhaar scheme will continue. First, the new government has stated that the UID scheme will continue. In support of the UID Scheme, the government has made budgetary allocation for the scheme to enable, inter-alia, it being speed-up. The government even intends to enact a law to give the scheme sanctity.
Secondly, the government is assigning the UID Number new uses. To track attendance of government employees, the government shall use a biometric attendance system, which is linked to the employees UID Number. The attendance will be uploaded onto a website, to boost transparency.

Third, direct benefit transfers under the UID will become more vigorous. The UID is already necessary for registration under the NPR, which is compulsory.

Providing one’s UID Number for utilities such as LPG or cooking gas is also compulsory in several areas, despite the courts diktat that it should not be so.


The government is in favor of continuing both the schemes. Therefore, it is unlikely that either scheme will be scrapped or that the two schemes will be combined. The registration for UID is becoming compulsory by implication as it is required for direct benefit transfers and for utilities. Data collected under NPR is being shared with the UIDAI by default, when one registers for a UID number. However, the reverse is unlikely, as the UID collects secondary data, whereas NPR requires primary data, which it collects through physical survey and authentication. Perhaps the sharing of data could be incorporated when one goes to the data collection centre to submit biometrics for the NPR. The subject could fill in the UID form and submit verification documents at this stage, completing both exercises in one go. This will drastically reduce the combined costs of the two exercises.

One unique solution is to hold the work of NPR till all the Aadhaar Card identities are completed. Once complete, the data collection based on census can actually pool all the Aadhaar cards together in one family under NPR. That means an NPR entity can have many Aadhaar enrollments of one family in one NPR entity. Essentially, this may happen when the entire family including senior citizens and infants hold Aadhaaar cards. Essentially, instead of only one benefit of Aadhaar based on DBT, if we roll out as an identity for an individual for a universal purpose, NPR can also be registered. Another unique solution is that an economic and caste census data stored in NPR registry for creating entities post-census. Here lies the Catch-22 situation. Is Aadhaar good enough to be with NPR, or should NPR be a separate identity based on caste and economic census?

All pix from Net

Anirban Kar

Anirban Kar is a technology and business consultant, who has earned his education degree in two continents, the USA and from India. His work started from 2003 in TCS, and comprised
of various clients ranging across geographies. His area of interest is business modeling,
enterprise architecture and investment analysis.