Examine the role of data minimization and consent-based design in India's digital identity architecture, with reference to the Aadhaar ecosystem and the DPDP Act.

Data minimization — collecting and disclosing only the data strictly needed for a stated purpose — and consent-based design are two of the seven principles underpinning the Digital Personal Data Protection Act, 2023 [3]. In a digital identity system of Aadhaar's scale, they are the safeguards that convert a mass authentication database into a rights-respecting public infrastructure.

How the principles operate in the Aadhaar ecosystem

• The redesigned Aadhaar App, dedicated to the nation in January 2026, is explicitly built around resident control, consent and data minimization, aligning UIDAI's practice with the DPDP framework [2].
• QR-based selective sharing lets a resident disclose only the specific credential a verifier needs, rather than the full Aadhaar letter — minimization made operational [2].
• Face verification and biometric lock/unlock place the decision to authenticate with the resident, making consent an affirmative act rather than a default [2].

Enabling ease of living without expanding data collection

• Free, app-based email ID addition/update, effective 1 July 2026 for six months, removed the need to visit an Aadhaar Seva Kendra; over 2.5 lakh updates occurred in two days [1].
• A linked email triggers real-time alerts on every authentication request, turning consent into a continuously auditable relationship [1].
• Earlier self-service reforms, such as 'Head of Family'-based online address update, show the same design logic of reducing intermediaries who would otherwise handle resident data [4].

Limitations that persist

• App-only, smartphone-dependent delivery risks excluding low-connectivity and low-literacy users, making consent formal rather than informed.
• Consent quality depends on grievance redress and enforcement machinery under the DPDP Rules, still maturing [3].

Data minimization and consent-based design have shifted Aadhaar from an authentication utility toward a privacy-by-design public good. Sustaining this requires assisted-consent channels for offline populations and time-bound operationalization of DPDP institutions, so that the constitutional right to privacy affirmed in Puttaswamy is realized in practice, not merely in architecture.