India's Digital Public Infrastructure (DPI) stack — Aadhaar, UPI, and DigiLocker — has been projected as a replicable model for developing nations. Evaluate the strengths and vulnerabilities of this model with reference to the new Aadhaar App ecosystem.

Q. India's Digital Public Infrastructure (DPI) stack — Aadhaar, UPI, and DigiLocker — has been projected as a replicable model for developing nations. Evaluate the strengths and vulnerabilities of this model with reference to the new Aadhaar App ecosystem. (15 marks, 250-350 words)

Digital Public Infrastructure means interoperable, publicly governed digital rails on which public and private services are built. India's stack — Aadhaar for identity, UPI for payments, DigiLocker for documents — rests on about 134 crore live Aadhaar holders [3]. Its architecture is genuinely exportable; its institutional preconditions are not.

Strengths demonstrated by the Aadhaar App ecosystem - Scale at low marginal cost: Aadhaar has processed over 17,000 crore authentications [3], and the new Aadhaar App crossed 31 million downloads within five months of its January 2026 launch [1]. - Self-service delivery: roughly 40 lakh mobile-number and 8.5 lakh address updates were completed in-app [1], cutting dependence on physical enrolment centres — decisive where administrative capacity is thin. - Privacy by design: selective sharing through customised QR codes, digitally signed verifiable credentials, and single-click biometric lock embed data minimisation [2], aligning with the DPDP Act, 2023 [4]. - Modularity: identity, payments and documents are unbundled layers, letting adopting states sequence rollout rather than import a monolith.

Vulnerabilities - Device-based exclusion: app-first delivery presumes smartphones and connectivity; the "One Family–One App" feature of five profiles per device [2] mitigates this but simultaneously concedes the device gap. - Adoption is shallow: 31 million downloads against 134 crore holders [1][3] shows downloads are not yet inclusion; legacy channels remain indispensable. - Systemic concentration: a single identity layer becomes a single point of failure, and breach liability and grievance redress remain thinly tested at this scale. - Missing institutional scaffolding: India's model presumes a statutory regulator under the Aadhaar Act, 2016 and privacy guardrails from the Puttaswamy judgment; states lacking these may replicate the technology without the accountability.

On balance, the stack's strengths lie in its architecture and its vulnerabilities in its context. India's DPI is therefore replicable as a design philosophy — open, modular, minimal-data — rather than as a turnkey product. Responsible export means bundling the code with a statute, a regulator and a redress mechanism, advancing SDG 16.9's promise of legal identity for all.

(~320 words)

Sources: 1. Aadhaar App crosses 31 million downloads (PIB/MeitY, 22 June 2026) — 31 million downloads in under five months; ~40 lakh mobile-number and ~8.5 lakh address updates 2. New Aadhaar App dedicated to the nation (PIB, 28 January 2026) — data minimisation, selective sharing, QR-based verification, multi-profile support 3. Aadhaar is the world's largest biometric identity system with approximately 134 crore live Aadhaar holders (PIB, Lok Sabha reply) — 134 crore live holders; 17,000 crore authentications 4. The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), MeitY — statutory data-protection framework the App's design aligns with