Unique Identification Authority of India (UIDAI)

The Unique Identification Authority of India (UIDAI) was established on 28 January 2009 as an attached office under the Planning Commission through an executive notification, with Nandan Nilekani as its first chairperson holding cabinet rank. For its first seven years the body operated without dedicated legislation, relying on executive sanction to enrol residents and assign Aadhaar numbers—a status that drew sustained constitutional challenge. Statutory footing arrived with the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, passed as a Money Bill under Article 110 of the Constitution. Section 11 of that Act constitutes UIDAI as a statutory authority under the Ministry of Electronics and Information Technology, comprising a chairperson, two part-time members, and a chief executive officer who serves as member-secretary. The Act mandates UIDAI to develop the policy, procedure, and systems for issuing Aadhaar numbers and to perform authentication.

The core procedural function is enrolment. A resident—defined under Section 2(v) as a person who has resided in India for 182 days or more in the twelve months preceding the application—approaches an enrolment agency operating under a registrar appointed by UIDAI. The agency captures demographic data (name, date of birth, gender, address) and biometric data: ten fingerprints, two iris scans, and a facial photograph. This packet is encrypted and transmitted to the Central Identities Data Repository (CIDR), where a process called de-duplication runs the new biometrics against the entire existing database to ensure no resident holds two numbers. Only upon successful de-duplication is a 12-digit Aadhaar number generated, the final digit being a Verhoeff checksum. The number is randomly assigned and carries no embedded intelligence about the holder.

The second pillar is authentication, governed by Section 8 of the Act and the Aadhaar (Authentication) Regulations, 2016. A requesting entity submits an Aadhaar number along with a demographic or biometric attribute to the CIDR, which returns a binary "yes/no" response confirming whether the submitted data matches the stored record. UIDAI also offers e-KYC, which returns digitally signed demographic data with the holder's consent, and the offline Aadhaar XML and the masked virtual ID (VID) introduced in 2018 to limit exposure of the actual number. UIDAI does not collect transaction purpose data, and the 2016 Act under Section 32(3) bars it from maintaining records of the purpose of authentication.

As of the late 2010s UIDAI had enrolled over 1.2 billion residents, making Aadhaar the world's largest biometric identity programme. Operationally it functions from its headquarters in New Delhi with regional offices in Bengaluru, Chandigarh, Delhi, Guwahati, Hyderabad, Lucknow, Mumbai, and Ranchi, and two data centres at Hebbal (Bengaluru) and Manesar (Haryana). The body works with registrars including state governments, banks, and the Department of Posts, and integrates with the Direct Benefit Transfer architecture through which subsidies such as LPG (the PAHAL scheme) and MGNREGA wages are disbursed.

UIDAI is frequently conflated with adjacent civil-services and governance bodies but is distinct from each. Unlike the National Population Register maintained by the Registrar General under the Citizenship Act, Aadhaar is not proof of citizenship and confers no rights of domicile—it certifies only residence and identity. It differs from the Election Commission's electoral photo identity card (EPIC) and the Income Tax Department's PAN, both of which are purpose-specific. As a statutory body created by an ordinary statute, UIDAI also differs from a constitutional body such as the Union Public Service Commission established under Article 315; UIDAI possesses no constitutional entrenchment and can be restructured by parliamentary amendment.

The programme's constitutional validity was settled in Justice K.S. Puttaswamy (Retd.) v. Union of India (2018), in which a five-judge bench upheld the Aadhaar Act by majority while reading down its scope. The Court struck down Section 57, which had permitted private corporate use of Aadhaar authentication, restricting mandatory linkage to schemes funded from the Consolidated Fund of India and to PAN-income tax filing. It barred mandatory Aadhaar for bank accounts, mobile connections, and school admissions. The 2017 Puttaswamy privacy judgment had earlier recognised informational privacy as a fundamental right under Article 21, framing the proportionality test the Court applied. Subsequent controversies have centred on authentication failures denying rations to entitled beneficiaries, data-leak allegations, and the 2019 amendment permitting voluntary offline verification by private entities.

For the working practitioner—whether a UPSC aspirant preparing General Studies Paper II, a governance researcher, or a desk officer—UIDAI exemplifies the modern Indian digital-state apparatus and the tension between welfare-delivery efficiency and civil-liberties safeguards. It anchors the JAM trinity (Jan Dhan, Aadhaar, Mobile) that underpins Direct Benefit Transfer and forms the identity layer of the India Stack alongside UPI and DigiLocker. Understanding its statutory architecture, the Puttaswamy limits on its reach, and its non-citizenship character is essential for any analysis of Indian e-governance, financial inclusion, or the comparative study of national biometric identity systems exported through initiatives such as the Modular Open Source Identity Platform (MOSIP).