UIDAI: what the Unique Identification Authority of India is, and what it cannot do

UIDAI full form, and what kind of body it is

UIDAI is the Unique Identification Authority of India. The name matters less than the kind of body it is, because that decides what it can be made to do and what it cannot.

It is not a department of the Government. Section 11 of the Aadhaar Act says the Central Government shall “establish an Authority to be known as the Unique Identification Authority of India to be responsible for the processes of enrolment and authentication”, and that the Authority “shall be a body corporate … having perpetual succession and a common seal” with power to hold property, contract, “and shall, by the said name, sue or be sued”. UIDAI’s own site dates its establishment under the Act to 12 July 2016 and places it under the Ministry of Electronics and Information Technology.

It is older than the Act, and the Act says so. Section 59 validates everything done under the Planning Commission resolution of 28 January 2009 and the Cabinet Secretariat notification of 12 September 2015 — the arrangements under which Aadhaar was being issued for seven years before Parliament legislated. The Act was amended by the Aadhaar and Other Laws (Amendment) Act, 2019, with effect from 25 July 2019; that amendment is where the civil-penalty chapter, the power to issue directions and the provisions on children’s Aadhaar numbers come from.

The Aadhaar Act sections that create and govern UIDAI

Most pages about UIDAI cite “the Aadhaar Act” and stop. The Authority is built out of particular sections, and each answers a question people actually ask. All are quoted from India Code, as amended to date.

What UIDAI is empowered to do

Section 23(1) sets the core: UIDAI “shall develop the policy, procedure and systems for issuing Aadhaar numbers to individuals and perform authentication thereof”. Section 23(2) then lists twenty heads. Grouped by what they mean for a resident, they come to five.

It decides what an Aadhaar is made of. UIDAI specifies, by regulation, the demographic and biometric information collected at enrolment and how it is verified; generates and assigns the numbers; and maintains and updates the Central Identities Data Repository. Section 31 gives you the right to ask it to alter your demographic or biometric information — and gives it the discretion: it “may, if it is satisfied, make such alteration”. An update is a request UIDAI decides, not an entitlement it must grant.

It can switch a number off. Section 23(2)(g) empowers it to omit and deactivate an Aadhaar number “in such manner as may be specified by regulations”. Section 3A adds one cancellation that is yours to trigger: a child enrolled with a parent’s consent may, within six months of turning eighteen, apply for cancellation, “and the Authority shall cancel his Aadhaar number”.

It runs authentication and polices those who use it. It performs authentication for requesting entities on conditions and fees it specifies (section 8), appoints Registrars and enrolling agencies and can revoke them (section 23(2)(i)), can inspect and audit them (section 23(2)(l)), and since 2019 can issue binding directions to “any entity in the Aadhaar ecosystem” (section 23A).

It can fine the ecosystem — on its own initiative. Chapter VIA makes an entity that breaches the Act, the rules, the regulations or a direction liable to a civil penalty; an adjudicating officer of UIDAI’s decides it; appeals go to the Telecom Disputes Settlement and Appellate Tribunal within forty-five days, and from there to the Supreme Court. The limit, in section 33B(2): “No inquiry under sub-section (1) shall be initiated except by a complaint made by the Authority.”

It sets fees and runs a grievance mechanism. Section 23(2)(o) lets it levy fees or authorise Registrars and agencies to collect them, which is why charges are set by UIDAI and printed on its schedule; section 23(2)(s) makes “setting up facilitation centres and grievance redressal mechanism” one of its functions. How that mechanism is used is covered on its own page.

What UIDAI is not empowered to do

This is the more useful half, because most frustration with Aadhaar comes from asking UIDAI for something it has no power over — or fearing it can do something the Act forbids.

It cannot make Aadhaar proof of citizenship. Section 9: the Aadhaar number or its authentication “shall not, by itself, confer any right of, or be proof of, citizenship or domicile”.

It cannot share your core biometrics. Section 29(1): no core biometric information “shall be shared with anyone for any reason whatsoever” or used for anything but generating numbers and authentication. Even a court order under section 33(1) cannot reach it — the proviso added in 2019 says “the core biometric information shall not be disclosed under this sub-section”.

It cannot hand over your data on an ordinary request. Disclosure of identity information or authentication records needs an order of a court “not inferior to that of a Judge of a High Court”, after hearing UIDAI and you (section 33(1)), or a national-security direction by an officer not below Secretary rank, reviewed by an oversight committee and valid for three months at a time (section 33(2)).

It cannot know why you authenticated. Section 32(3): UIDAI “shall not, either by itself or through any entity under its control, collect, keep or maintain any information about the purpose of authentication”. Its own mythbusters add that it holds no information about your bank accounts, shares, investments or property — a bank authenticating you gets a yes or no, and UIDAI learns nothing about the account.

It cannot make a private company demand Aadhaar. Section 57, which allowed any body corporate or person to use Aadhaar for identification under a contract, was held unconstitutional in that part by the Supreme Court in 2018 and omitted by the 2019 amendment. What remains is section 4: use is voluntary unless “required by a law made by Parliament”, and an entity that asks must offer alternatives and “shall not deny any service” for refusing.

It does not run the things people most often blame it for. Enrolment centres are operated by enrolling agencies appointed by Registrars, not by UIDAI staff. Bank KYC is the bank’s. The mapper that decides which bank receives a subsidy is NPCI’s, updated only by banks — UIDAI’s own DBT FAQ says the seeding status it shows is fetched from NPCI and that UIDAI “is not responsible for its correctness”.

It cannot start a criminal case for you — but you can, for some offences. Section 47 lets a court take cognisance of an offence under the Act only on a complaint by UIDAI or someone it authorises, with a 2019 proviso letting an Aadhaar number holder complain directly of offences under sections 34, 35, 36, 37, 40 and 41 — impersonation, disclosure of identity information and misuse by a requesting entity among them.

How UIDAI is structured

At the top is the Authority itself: a Chairperson, two part-time Members, and the chief executive officer as Member-Secretary. Below it, UIDAI describes its head office in New Delhi as the CEO “supported by eight Deputy Directors General (DDGs), who are Joint Secretary–level officers overseeing key functional areas”, with a sanctioned strength of 134.

Outside Delhi, UIDAI lists eight regional offices, “each … led by a Deputy Director General (DDG)” with directors, assistant directors general, deputy directors and section officers beneath; state offices under several of them; a technology centre that runs the IT infrastructure; and data centres in Bengaluru and Manesar.

None of that is where you enrol. Section 23(3)(b) lets UIDAI appoint Registrars and authorise agencies, and its Citizen’s Charter defines a Registrar as an entity authorised “for the purpose of enrolling individuals” and an enrolling agency as one appointed “for collecting demographic and biometric information”. The operator at the counter works for an enrolling agency under a Registrar. That distinction is why a refusal at a centre is not UIDAI’s last word.

UIDAI regional offices and the States each one covers

UIDAI publishes a fixed jurisdiction for each of its eight regional offices, and that table is reproduced below exactly as UIDAI publishes it. A regional office does not do enrolments or updates over a counter; its role in a resident’s life is the exceptions. UIDAI’s Citizen’s Charter says that a third name update, a second gender update or a second date-of-birth update is carried out at an Aadhaar centre and then sent “to concerned Regional Office of UIDAI for approval of update under exception”, which carries out due diligence, may ask for more information or a field investigation, and passes genuine cases to the technology centre.

Several States also have a state office, which reports to a regional office. UIDAI lists six: Thiruvananthapuram for Kerala under Bengaluru, Bhopal for Madhya Pradesh under Delhi, Bhubaneswar for Odisha under Hyderabad, Ahmedabad for Gujarat under Mumbai, and Kolkata for West Bengal and Patna for Bihar under Ranchi.

Two notes on UIDAI’s own tables. UIDAI lists Dadra & Nagar Haveli and Daman & Diu under Mumbai as two separate entries, and the table keeps its wording. And UIDAI’s summary table puts Kolkata and Patna together against West Bengal, while each office’s own entry names its State — the Patna office is headed “State Office Patna (Bihar)”. The table here follows each office’s own entry.

What to do with a regional office — writing to it, walking in, escalating to it — is a grievance question, and it is covered in full on the UIDAI complaint page, with the routes and what each is good for.

What UIDAI commits to: its Citizen’s Charter service standards

UIDAI publishes a Citizen’s Charter setting out a service standard for each service and the share of cases it expects to meet it. They are the nearest thing to a published promise UIDAI makes, and almost no page about UIDAI mentions them. The main ones are set out on this page, each with its date.

Read them for what they are. They are “normally” figures, met in a stated share of cases — 90 or 95 per cent — not guarantees for any one request. And the charter now on UIDAI’s site is the January 2024 edition, which gave its own next review as “January 2025 or before if need arises”; no later edition was published when this page was checked. Its figures on timing are consistent with UIDAI’s current FAQ — updates “typically” 30 to 90 days, about 90 per cent within 30 — but its figures on fees are not: it prices a document update at ₹50 at a centre and ₹25 online, which UIDAI’s current charges schedule has replaced. The charter itself says to refer to the website for the latest charges.

The charter also states the rule that ties service standards to complaints: UIDAI will accept a grievance about a service “only after the given timelines … has exceeded its given time limit”. In other words, the standard is also the waiting period before a complaint is entertained. The complaint route itself is on its own page.

Who UIDAI answers to

Four lines of accountability run through the Act. The Central Government can give UIDAI binding directions on questions of policy — though section 50 expressly bars directions “pertaining to technical or administrative matters undertaken by the Authority” — and can, under section 48, supersede the Authority for up to six months if it cannot or persistently does not discharge its functions, with a report laid before Parliament.

Its accounts are audited annually by the Comptroller and Auditor-General, and the audit report is laid before each House of Parliament (section 26). It must prepare an annual report of its activities, accounts and programme of work, also laid before Parliament (section 27). And as a public authority it is subject to the Right to Information Act, 2005; UIDAI publishes its public information officers and appellate authorities on its site.

Where complaints about UIDAI are covered

This page explains the institution and deliberately carries no complaint procedure; the channels, the order to use them in and what each is good for are on the UIDAI complaint page.

Worked examples