Digital public infrastructure and the data layer

Detail

1. What is Digital Public Infrastructure (DPI)?

• DPI means open, interoperable digital systems built as public goods. There are three core types: identity, payments and data sharing.
• Interoperable means different systems and apps can work with each other. For example, a PhonePe user can pay a Paytm user.

• Public good means the basic system is built once, usually by the state or a non-profit body, and anyone can use it.

• The basic model: a public "road" (the rail) and many private "vehicles" (the apps).

• The government or a public body builds the common rail.
• Private companies build competing products on top of it.
• Competition keeps costs low, and no single firm owns the customer.

2. India Stack — the layers

Layer	Components	What it does
Identity	Aadhaar, e-KYC, eSign	Proves who you are online. e-KYC (electronic "Know Your Customer") checks identity digitally instead of on paper. eSign lets you sign documents online.
Payments	UPI, AePS	UPI gives instant bank-to-bank transfers through apps. AePS (Aadhaar-enabled Payment System) lets you withdraw cash or pay using Aadhaar and a fingerprint, often at a banking correspondent.
Data	DigiLocker, Account Aggregator, DEPA	DigiLocker is a digital locker for official documents. Account Aggregator moves financial data with your consent. DEPA (Data Empowerment and Protection Architecture) is the consent-based design idea behind the data layer.
Extensions	ONDC (2022), OCEN, ULI (2024)	ONDC (Open Network for Digital Commerce) is an open network for e-commerce. OCEN (Open Credit Enablement Network) is a common "language" for lenders and loan apps. ULI is RBI's lending platform.

3. Unified Lending Interface (ULI): status update

• What it is: an RBI technology platform to make loans "frictionless" (quick, with little paperwork) [6].
• How it works:
• It uses open APIs. An API (Application Programming Interface) is a standard digital "plug" that lets two computer systems talk to each other.
• Lenders connect in a "plug and play" way [5][6].

• It brings data from many sources into one place: Aadhaar e-KYC, state land records, PAN validation and Account Aggregators [5][6].

• Timeline:

• The pilot began in August 2023 under the name Public Tech Platform for Frictionless Credit (PTPFC), developed by the Reserve Bank Innovation Hub.

• It was renamed ULI and national roll-out was announced in August 2024 [7]. (NCERT: "announced 2024 (verify status)")

• Scale: as of 12 December 2025, 64 lenders (41 banks + 23 NBFCs) had joined [5][6].

• Next step: it is being extended to customers of Regional Rural Banks (RRBs) and District Central Co-operative Banks (DCCBs), to reach rural and semi-urban borrowers [5].
• Why land records matter:
• A farmer's loan needs proof of land.
• ULI pulls the digital land record directly from the state.
• So the bank does not need a paper visit, and the loan is approved faster.

4. DPI diplomacy: G20 New Delhi (2023)

• The Leaders' Declaration (9–10 September 2023) adopted a framework for systems of DPI [4].
• Three DPI deliverables were first endorsed unanimously at the G20 Digital Economy Ministers' Meeting and then affirmed in the Leaders' Declaration [3]:
• a Framework for building DPI;
• mobilising finance for DPI in Low- and Middle-Income Countries (LMICs);

• a Global DPI Repository, to share information and best practices.

• Global DPI Repository (GDPIR):

• Built by MeitY.

• It holds 50+ DPIs from 16 countries (2023) [3].

• Social Impact Fund (SIF):

• Announced by the Prime Minister (2023).
• India pledged an initial USD 25 million [3].
• It is a government-led, multi-stakeholder fund (many partners join in).
• It pays for technical and non-technical help to Global South countries in the early stages of building DPI [3].

5. International comparisons

Model	Example	Who owns the rails?
Public rails + competing private apps	India (UPI)	Public or non-profit body; many private apps compete
Central-bank-run fast payment	Brazil's Pix (2020), Singapore's PayNow	The central bank or public system
Card-network-led	USA	Private card networks
Big-tech-wallet-led	China's Alipay, WeChat Pay	Private tech giants (closed systems)

• The key difference: in the US and China, private firms own the rails. They can charge fees and keep customer data inside their own walls. India's model keeps the rail neutral.

6. The data layer: Account Aggregator (AA)

• Definition: an RBI-regulated, consent-based intermediary. It lets a person safely share their financial data held at one institution with another institution.
• Legal form: an NBFC-AA (Non-Banking Financial Company – Account Aggregator), under the RBI Master Direction of 2016 [2].
• Launch: the network went live on 2 September 2021 [2]. (NCERT: "September 2021")

The players

• Financial Information Providers (FIPs): banks, insurers, mutual funds and others that hold your data.
• Financial Information Users (FIUs): lenders, wealth managers and others that want your data.
• AA: the pipe in the middle. It carries data only with your explicit consent, for a stated purpose and period.
• Data-blind: the AA passes on encrypted data (data locked in a code). It cannot read or store that data.
• Cross-sector: AAs are licensed by RBI. The providers can be regulated by RBI, SEBI, IRDAI or PFRDA. This lets bank, securities, insurance and pension data flow on one network.

How a loan works through an AA (example)

• A small shop owner applies to an NBFC (the FIU) for a loan.
• The NBFC asks for 12 months of bank statements, through an AA.
• The shop owner approves the consent on their phone. The consent states the purpose (loan check) and the time limit (for example, one-time access).
• The bank (the FIP) sends the encrypted statement through the AA. The NBFC decrypts it and assesses the loan.

Scale (at the four-year mark, September 2025) [2]

• 2.2 billion financial accounts can share data through AAs.
• 112.34 million (≈11.2 crore) users have linked their accounts.
• 112 institutions are live as both FIP and FIU, 56 as FIP only and 410 as FIU only.

Why the AA matters: cash-flow-based lending

• Thin-file borrowers: people or MSMEs (micro, small and medium enterprises) with little credit history and no collateral (property or assets pledged as security for a loan).
• Old method: no credit score and no collateral → no loan.
• New method: the lender reads real cash flows (sales, GST data, bank inflows) → it can judge the ability to repay → it can lend without collateral.

7. Open banking and India's variant

• Open banking: banks share customer data with third-party providers, with the customer's consent, through secure APIs, so that new services can be built.

• Examples: the EU's PSD2 (second Payment Services Directive) and the UK's open-banking rules.

• India's variant:

• A separate regulated consent manager (the AA) sits in between.
• Banks do not deal directly with each third party.
• The customer controls consent from one place.

8. Privacy: the Digital Personal Data Protection (DPDP) Act 2023

• Core duties: consent, purpose limitation (use data only for the stated purpose) and data-fiduciary duties.
• A Data Fiduciary is the entity that decides why and how personal data is used, such as a bank or an app.

• A Data Principal is the person the data belongs to.

• Consent notice: every Data Fiduciary must give a separate, clear and easy-to-understand consent notice that states the specific purpose [8].

• Consent Managers:
• Through a Consent Manager, a Data Principal can give, manage, review or withdraw consent.
• The Consent Manager is accountable to the Data Principal and acts on their behalf.
• It must register with the Data Protection Board [8][9].

• This is the same idea as the AA, now applied to all sectors.

• DPDP Rules, 2025: the Rules were notified on 13 November 2025. This made the Act's framework operational [8].

Prelims Hooks

• Account Aggregator = an NBFC-AA regulated by RBI under the Master Direction, 2016. The network went live on 2 September 2021.
• FIP = holds the data (for example, a bank). FIU = uses the data (for example, a lender). AA = data-blind consent pipe. Trap: the AA does not store or read data.
• Unified Lending Interface was developed by the Reserve Bank Innovation Hub. It was piloted in 2023 as PTPFC and renamed ULI in August 2024. It had 64 lenders (December 2025).
• ONDC (2022) is for e-commerce. OCEN is for credit. Trap: neither is a payment system.
• G20 New Delhi (2023): framework for DPI, Global DPI Repository (50+ DPIs, 16 countries) and Social Impact Fund (India's pledge: USD 25 million).
• Brazil's Pix (2020) is run by the central bank. Alipay and WeChat Pay are private big-tech wallets.
• PSD2 is the EU's open-banking law. It is not Indian.
• DPDP Act 2023; the DPDP Rules were notified on 13 November 2025. Consent Managers register with the Data Protection Board.
• AePS belongs to the payments layer and eSign to the identity layer. A "match the layer" trap is common.

Mains Points

• Public rails vs private rails:
• India's DPI model (public rail + competing apps) lowers entry barriers, stops platform monopolies and speeds up financial inclusion.
• Compare the fee-heavy card model in the US and the walled gardens of China's big-tech wallets.

• Use this in GS-III answers on inclusive growth and competition.

• Data as collateral:

• AA, GST data and ULI allow cash-flow-based lending to thin-file MSMEs and farmers. This can narrow the MSME credit gap.

• Risks: over-lending by digital lenders, and algorithmic bias in credit scoring.

• Consent vs convenience:

• The AA's consent architecture and the DPDP Act's Consent Managers put users in control.
• Real consent needs digital literacy, notices in local languages, and a Data Protection Board that can act firmly.

• Link the AA's data-blind design to the right to privacy, recognised as a fundamental right in Puttaswamy (2017) (GS-II).

• DPI as soft power:

• The G20 framework, the GDPIR and the USD 25 million SIF make India a DPI provider for the Global South.
• Challenges: adapting DPI to other countries' laws, and questions of data sovereignty.