Digital public infrastructure

Also called: DPI · Topic: Transparency, Accountability and e-Governance · NCERT: Beyond NCERT

Meaning

Digital public infrastructure (DPI) means shared digital systems built as public goods (things made for everyone to use, like a public road). They are open and interoperable, which means different systems can connect and work together. Government and private services are both built on top of them. Aadhaar, UPI and DigiLocker are examples.

DPI matters because it lets the state deliver welfare and services to crores of people at once. It also lets the state track each rupee it spends. Because of this, it raises hard questions about privacy, surveillance (the state watching people) and exclusion (genuine people being denied benefits).

Explanation

How DPI works: the India Stack

• India Stack is India's set of DPI layers.
• Each layer offers open APIs. An API is a ready-made software link that other apps can plug into.
• Together, the layers let a service work without the person being present, without paper and without cash.

Layer	Purpose	Main components
Identity	Prove who you are	Aadhaar, e-KYC (electronic Know Your Customer: a verified copy of name, address and photo, sent with consent), eSign (signing a document online using Aadhaar)
Payments	Move money	UPI (2016, run by the National Payments Corporation of India, NPCI), AePS (cash withdrawal with a fingerprint at a local banking agent), APB (Aadhaar Payment Bridge, which sends money to the bank account linked to an Aadhaar number)
Data	Share records with consent	DigiLocker (official documents stored online), Account Aggregators (consent-based sharing of financial data; RBI framework 2016, live 2021)

• Think of it like a road. The government builds the road once. Many vehicles, public and private, then use it.

Design principles

• Open, interoperable and public base. The core platforms belong to no single company.
• Private companies build on top.
• Payment apps run on UPI.

• Fintech firms run on Account Aggregators.

• Consent. Data is shared only when the person agrees.

• Minimum data. Only what is needed is shared.
• Example: Aadhaar authentication gives only a "yes/no" answer, not the person's full data (s.8, Aadhaar Act, 2016).
• Offline verification works through a QR code or an XML file, without contacting UIDAI's central database.

What DPI delivers: DBT and JAM

• JAM trinity = Jan Dhan bank account + Aadhaar + Mobile phone. The term was used in the Economic Survey 2014–15.
• Jan Dhan = where the money arrives.
• Aadhaar = proof of who should get it.

• Mobile = alerts and payments.

• Direct Benefit Transfer (DBT) runs on JAM. It pays benefits straight into a beneficiary's bank account. It began on 1 January 2013.

• Leakage is money lost on the way to the poor family. DPI cuts it in three ways:
• removing ghost beneficiaries (fake or dead people still on the list);
• removing duplicate beneficiaries (one person listed twice);

• cutting out middlemen.

• Scale (government figures):

• About ₹3.48 lakh crore saved by plugging leakages, and subsidies fell from 16% to 9% of total government spending [5].
• Over ₹51 lakh crore paid to 176 crore beneficiaries by June 2026 [6].
• Aadhaar authentication passed 150 billion transactions (2025) [9].
• Jan Dhan accounts grew from 14.72 crore (2015) to 57.71 crore (March 2026) [6].

Limits and risks

• Concentration of data. One central database is attractive to hackers. It also makes it possible to profile people.
• Exclusion error. Fingerprints fail, networks fail, or records do not match. Genuine people then lose food or pensions.
• Part of the claimed "savings" may be genuine people who were cut from lists.

• Face authentication is spreading to help elderly people and manual workers whose fingerprints have worn out.

• Function creep. A tool built for welfare slowly spreads to many other uses.

• Weak oversight of operators.
• NPCI is a not-for-profit company owned by banks. It does not fully come under the RTI Act or direct parliamentary control.
• UIDAI's grievance system has been criticised as weak.

In the Constitution and practice

• No single law covers DPI. Each layer stands on a different legal base:
• Aadhaar: the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016. This Act made UIDAI a statutory body (a body created by an Act of Parliament) under MeitY. UIDAI was first set up in January 2009 by executive notification (a government order, not a law) under the Planning Commission.
• UPI: the Payment and Settlement Systems Act, 2007, and RBI rules.
• DigiLocker and some other layers: mostly rules and executive orders, not their own Acts.

• General data protection: only with the Digital Personal Data Protection (DPDP) Act, 2023.

• Money Bill controversy (Article 110). The Aadhaar Act was passed as a money bill (a bill only about taxes, borrowing or spending from the Consolidated Fund).

• The Lok Sabha Speaker's certificate is final (Article 110(3)).
• The Rajya Sabha can only make recommendations, within 14 days.

• Critics said this route was used to get around the Rajya Sabha, where the government had no majority.

• K.S. Puttaswamy (2017): a nine-judge bench held that privacy is a fundamental right under Article 21.

• K.S. Puttaswamy (Aadhaar case), 26 September 2018 (4:1): the Court used the proportionality test. A limit on privacy must be backed by a law, serve a legitimate aim, be necessary and be balanced.
• Upheld: s.7 (Aadhaar for benefits paid from the Consolidated Fund of India, Article 266), PAN–Aadhaar linking (s.139AA, Income-tax Act, 1961) and the Money Bill route.
• Struck down: s.57 (private use under a mere contract). Aadhaar can be required only where a law shows its use is necessary and proportionate [3].
• Not mandatory: bank-account linking and mobile SIM linking [3].
• Data limit: authentication logs may be kept for at most 6 months.

• Dissent: Chandrachud J called the Money Bill route a "fraud on the Constitution" and warned of surveillance and exclusion.

• Rojer Mathew v South Indian Bank (2019) referred the Money Bill question to a seven-judge bench. It is still pending as of the latest available information.

• Aadhaar and Other Laws (Amendment) Act, 2019: s.57 was omitted [4]. Banks and telecom companies may use Aadhaar KYC voluntarily, only with consent [4]. Offline verification was recognised in law. A child can cancel their Aadhaar on turning 18.
• Good Governance (SWIK) Amendment Rules, January 2025: non-government entities may use Aadhaar authentication for public-interest purposes, such as ease of living, in sectors like e-commerce, travel, hospitality and health [1]. They need government approval, applied for through the swik.meity.gov.in portal [2].
• DPI goes global:
• At the G20 New Delhi Summit (9–10 September 2023), the Leaders' Declaration welcomed the G20 Framework for Systems of Digital Public Infrastructure. This framework is voluntary [8][9].
• The Digital Economy Ministers endorsed three DPI deliverables: a framework for building DPI, a plan to raise money for DPI in low- and middle-income countries, and the Global DPI Repository (GDPIR) [9].
• The Prime Minister announced the GDPIR was complete, along with a Social Impact Fund for DPI in the Global South (November 2023) [7].
• The GDPIR lists 54 DPIs from 16 countries, and India has contributed the most [9].
• UPI is live in over eight countries, including the UAE, Singapore, Bhutan, Nepal, Sri Lanka, France, Mauritius and Qatar [9].

Don't confuse with

• India Stack: DPI is the general idea, an open, shared public platform. India Stack is India's own set of DPI layers (identity, payments, data).
• DBT (Direct Benefit Transfer): DBT is a way of delivering welfare (money straight into bank accounts). DPI is the infrastructure it runs on.
• JAM trinity: JAM (Jan Dhan + Aadhaar + Mobile) is the base for DBT, named in the Economic Survey 2014–15. India Stack's data layer (DigiLocker, Account Aggregators) is not part of JAM.
• Closed private platform: a private platform belongs to one company, which controls who uses it. DPI is open and interoperable, so any public or private player can build on it.

Prelims Hooks

• India Stack layers: UPI (2016, NPCI) = payments; Account Aggregator (RBI framework 2016, live 2021) = data; eSign = identity.
• G20 New Delhi Declaration (2023) welcomed the G20 Framework for Systems of DPI. It is voluntary, not binding [8][9].
• The Global DPI Repository lists 54 DPIs from 16 countries [9]. It came with a Social Impact Fund for the Global South [7].
• Trap: UPI rests on the Payment and Settlement Systems Act, 2007, not the Aadhaar Act. DigiLocker has no Act of its own.
• Trap: NPCI, which runs UPI, is a not-for-profit company owned by banks. It is not a statutory body and does not fully come under the RTI Act.
• Aadhaar case (2018): s.57 (private use by contract) was struck down [3] and omitted in 2019 [4]. The SWIK Rules (2025) reopen private use only with government approval [1].

Mains Points

• Efficiency against rights:
• For: JAM and DBT cut leakages (about ₹3.48 lakh crore in claimed savings [5]) and make the state answerable for each rupee.

• Against: exclusion errors, surveillance and data concentration. Under the Puttaswamy proportionality test (2017, 2018), every Aadhaar requirement needs a law, a legitimate aim, necessity and balance.

• Accountability gaps in DPI governance:

• Problem: layers like DigiLocker have no law of their own, and operators like NPCI face limited RTI and parliamentary oversight.

• Reforms: give each layer a law of its own, add independent audits, set up a strong regulator under the DPDP Act, 2023, and keep offline fallbacks so that no one is excluded.

• DPI as soft power and a governance model:

• Strength: open public platforms with private innovation on top, now promoted through the G20 Framework (2023) and the GDPIR [8][9].
• Caution: function creep. The 2025 SWIK Rules allow private use through approval, not through a law. Whether this meets the 2018 judgment's demand for a law that shows necessity is open to debate.

Related concepts

• Aadhaar
• Unique Identification Authority of India
• Aadhaar case
• Direct Benefit Transfer
• JAM trinity
• India Stack

Read more

• Aadhaar, DBT and digital public infrastructure