The expansion of private verification entities in the Aadhaar ecosystem raises regulatory concerns. Suggest safeguards in light of data protection law.

The Aadhaar and Other Laws (Amendment) Act, 2019 removed Section 57 and created offline verification, an identity check that does not run against UIDAI's database [1]. Offline Verification Seeking Entities (OVSEs), such as hotels, clinics and gig platforms, grew from about 100 in April 2026 [6] to 300 [2]. Private use is growing faster than oversight.

Regulatory concerns

• The regulator cannot see the checks: the QR scan happens locally, so UIDAI keeps no log. The only evidence is the consent record held by the OVSE itself [2][3].
• Poor past enforcement: CAG Report No. 24 of 2021 found that UIDAI skipped the infrastructure checks its own rules required for requesting entities. It had also received no audit reports from them [4].
• Self-reporting: OVSEs must report misuse within 72 hours [3], but usually only the OVSE knows the misuse happened.
• Two routes, unequal checks: private authentication under the 2025 Good Governance Amendment Rules needs ministry approval [5]. OVSEs from the same sectors are onboarded directly by UIDAI [2].
• Risk of coercion: the non-denial rule forbids refusing service to anyone who can identify themselves another way [3], yet no data on refusals is published [2].

Safeguards in light of data protection law

• Treat OVSEs as Data Fiduciaries: enforce the DPDP Act, 2023 duties to keep security safeguards and to report breaches to the Data Protection Board and affected persons, with penalties for violations [7].
• Data minimisation: enforce the statutory ban on storing Aadhaar numbers or biometrics [1], and make masking mandatory [3].
• Check before entry: audit an OVSE's systems before onboarding it, closing the gap CAG flagged [4].
• Yearly sample audits of consent records, with suspension of OVSEs that do not comply [3][4].
• Publish outcome data: number of verifications, refusals, misuse reports and actions taken.
• One public registry of entities approved under both routes, so residents can check legitimacy [2][5].
• Privacy by default: the App should share masked details unless the resident chooses otherwise. Its locks are currently opt-in [2].

Offline verification already reduces reliance on photocopied Aadhaar. Its credibility now depends on enforcement. Bringing OVSEs under the DPDP Act's accountability regime would uphold the Article 21 privacy right affirmed in Puttaswamy (2017). It would also make Aadhaar a trusted Digital Public Infrastructure.