Aadhaar Hits 134 Crore Users, Govt Details Multi-Layered Security Shield

Union Minister of State for Electronics and Information Technology Jitin Prasada in the Lok Sabha, noted that the Aadhaar ecosystem is designed to protect privacy. According to the Ministry, demographic data remains encrypted both at rest and in transit.

By design and architecture, the storage and processing of Aadhaar data takes place within India, and safeguards are in place to ensure that this is not breached.

The UIDAI provides Aadhaar authentication services to authorised entities to verify an individual's identity against the central database. This verification confirms the individual's identity using a one-time password (OTP), biometric data such as fingerprints, iris, and face, or demographic details to deliver specific services.

The Ministry specified that the Aadhaar Face Authentication used by these authorised entities is based on AI and Machine Learning technology, which enables accurate authentication of face biometrics.

Any entity desiring to use these services must be onboarded with UIDAI as an Authentication User Agency (AUA) or a KYC User Agency (KUA), in accordance with the provisions of the Aadhaar Act. The regulatory framework requires every AUA or KUA to retain authentication logs for two years. These logs can be accessed by the Aadhaar number holder or shared for grievance redressal and dispute resolution. After the initial two-year period, the logs are archived for five years and subsequently deleted.

To maintain the security of the system, UIDAI has implemented a three-tier audit framework. This includes the Self-Compliance Audit, the Information Security Annual Audit, and the Governance, Risk, Compliance, and Privacy (GRCP) Audit for entities within the ecosystem. This multi-layered approach ensures the integrity, security, and effectiveness of the system while helping to mitigate risks to Aadhaar number holders.

The Ministry further highlighted that detailed Standard Operating Procedures (SOPs) and guidelines governing the collection and use of data are available in the public domain. Key provisions include the mandatory informed consent of the Aadhaar number holder and the requirement that authentication is performed only for predefined and explicitly permitted purposes.

Security protocols also mandate the use of certified devices and secure storage within the Aadhaar Data Vault. Under the current guidelines, there is a strict prohibition on biometric data retention by any entity.

The Aadhaar Act also imposes restrictions on the collection, retention, and access of data, ensuring limited and encrypted data retention alongside mandatory audit trails.

- ANI