Is Aadhaar number personal data under DPDPA?

What the Law Says

The Digital Personal Data Protection Act, 2023 (DPDPA) defines and regulates personal data in India. Aadhaar number is explicitly covered because it directly identifies a natural person.

Under Section 2(1)(o) of the DPDPA, 'personal data' means any data about an individual who is identifiable by such data or other information that is in the possession of, or likely to come into the possession of, a Data Fiduciary.

Aadhaar number is a unique 12-digit identity number issued by UIDAI to Indian residents. Since it is designed to identify individuals and is linked to biometric and demographic information, it satisfies the test of identifiability under the Act.

Section 2(t) defines 'identifiable individual' as one who can be identified, directly or indirectly, by reference to an identifier such as an Aadhaar number — confirming its status as personal data.

Further, Section 8(5) permits processing of personal data without explicit consent only in limited cases — e.g., for compliance with law or for prevention of offences — but does not exclude Aadhaar from being treated as personal data. Instead, it subjects its processing to strict conditions.

Section 9(4) mandates that Data Fiduciaries implement 'appropriate technical and organisational measures' to protect personal data — including Aadhaar numbers — against unauthorised access, disclosure, or destruction.

Statutory Text

‘personal data’ means any data about an individual who is identifiable by such data or other information that is in the possession of, or likely to come into the possession of, a Data Fiduciary

— Digital Personal Data Protection Act, 2023, s. 2(1)(o) — Definition of personal data

Statutory Text

‘identifiable individual’ means an individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number...

— Digital Personal Data Protection Act, 2023, s. 2(t) — Definition of identifiable individual

Statutory Text

Every Data Fiduciary shall implement appropriate technical and organisational measures to ensure the security of personal data

— Digital Personal Data Protection Act, 2023, s. 9(4) — Security safeguards

Sources