May be called the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016; extends to the whole of India (subject to J&K reorganisation) and comes into force on notified dates.
Defines the key terms, including 'Aadhaar number', 'authentication', 'biometric information', 'core biometric information', 'demographic information', 'identity information', 'requesting entity', 'offline verification-seeking entity', 'Central Identities Data Repository' and 'resident'.
(Enrolling agency) At enrolment, inform the resident of how the information will be used and shared (s.3(2)).
Provides for enrolment and the Aadhaar number of children, with consent of the parent/guardian and an option to cancel on attaining 18.
An Aadhaar number is unique, may be used/accepted as proof of identity subject to authentication or offline verification; a virtual/alternative number may be used to conceal the actual Aadhaar number.
The Authority shall take special measures to issue Aadhaar numbers to women, children, senior citizens, persons with disability, unskilled/migrant workers and other disadvantaged groups.
(Aadhaar number holder) Update demographic/biometric information as required.
Provide an alternate means of identification where Aadhaar authentication is not possible.
(Requesting entity) Obtain the individual's informed consent before authentication (s.8(2)); inform them of the use and alternatives (s.8(3)); use identity information only for the stated purpose.
AAD-RE-01 (RequestingEntity): Obtain informed consent before authentication. Breach: Failure to obtain the individual's informed consent before authentication / offline verification. Penalty: Unauthorised use of identity information in contravention of s.8(2)/s.8A(2) -> s.40 (imprisonment up to 3 years, or fine up to Rs.10,000 / Rs.1 lakh for a company, or both); plus civil penalty up to Rs.1 crore (s.33A, adjudicated u/s 33B).
AAD-RE-02 (RequestingEntity): Use identity information only for the stated purpose. Breach: Using identity information for a purpose other than the one disclosed to the individual. Penalty: Unauthorised use by a requesting entity -> s.40 (up to 3 years / fine); unauthorised disclosure -> s.37; plus civil penalty up to Rs.1 crore (s.33A).
(Offline verification-seeking entity) Obtain consent; do not seek core biometric information; use information only for the stated purpose (s.8A(2)-(3)).
An Aadhaar number or authentication is not, by itself, proof of citizenship or domicile.
The Authority may establish and maintain one or more Central Identities Data Repositories (CIDR).
Establishes the Unique Identification Authority of India as a statutory body.
Provides for the composition of the Authority (Chairperson and Members).
Sets the qualifications for appointment of the Chairperson and Members.
Provides for the term and conditions of service of the Chairperson and Members.
Provides for the removal of the Chairperson and Members.
Restricts post-office employment of the Chairperson/Members.
Provides for the functions of the Chairperson.
Provides for the Chief Executive Officer of the Authority.
Provides for the meetings and procedure of the Authority.
Vacancies or defects do not invalidate the Authority's proceedings.
Provides for the officers and employees of the Authority.
Provides for transfer of assets and liabilities to the Authority.
(Authority) Perform its statutory functions and maintain the security of the CIDR.
(Entities in the Aadhaar ecosystem) Comply with directions issued by the Authority (s.23A).
Provides for grants by the Central Government to the Authority.
Provides for the constitution of the Authority's Fund.
Provides for the accounts of the Authority and their audit by the CAG.
Provides for returns and the annual report of the Authority.
(Authority / entities) Ensure the security and confidentiality of identity information; protect it against unauthorised access.
AAD-RE-03 (RequestingEntity): Secure identity information held by the entity. Breach: Failure to implement security measures to protect identity information from unauthorised access. Penalty: Unauthorised access to the CIDR -> s.38 (imprisonment up to 10 years and fine not less than Rs.10 lakh); plus civil penalty up to Rs.1 crore (s.33A); residual general penalty s.42.
(All entities) Do not share core biometric information; use identity information only for the purpose disclosed to the individual (s.29(3)).
AAD-RE-02 (RequestingEntity): Use identity information only for the stated purpose. Breach: Using identity information for a purpose other than the one disclosed to the individual. Penalty: Unauthorised use by a requesting entity -> s.40 (up to 3 years / fine); unauthorised disclosure -> s.37; plus civil penalty up to Rs.1 crore (s.33A).
AAD-RE-03 (RequestingEntity): Secure identity information held by the entity. Breach: Failure to implement security measures to protect identity information from unauthorised access. Penalty: Unauthorised access to the CIDR -> s.38 (imprisonment up to 10 years and fine not less than Rs.10 lakh); plus civil penalty up to Rs.1 crore (s.33A); residual general penalty s.42.
AAD-RE-05 (RequestingEntity): Do not collect, use or store core biometric information. Breach: Collecting, using, storing or sharing core biometric information. Penalty: Sharing/using core biometric information in contravention of s.29 -> s.38 (up to 10 years and fine not less than Rs.10 lakh) / s.37 (disclosure); plus civil penalty up to Rs.1 crore (s.33A).
AAD-RE-06 (RequestingEntity): Report and remediate unauthorised access. Breach: Failure to report and remediate an unauthorised access to, or breach of, identity information. Penalty: Unauthorised access -> s.38 (up to 10 years and fine not less than Rs.10 lakh); tampering with CIDR data -> s.39 (up to 10 years); plus civil penalty up to Rs.1 crore (s.33A).
Treat biometric information as sensitive personal data and apply IT Act, 2000 safeguards.
AAD-RE-03 (RequestingEntity): Secure identity information held by the entity. Breach: Failure to implement security measures to protect identity information from unauthorised access. Penalty: Unauthorised access to the CIDR -> s.38 (imprisonment up to 10 years and fine not less than Rs.10 lakh); plus civil penalty up to Rs.1 crore (s.33A); residual general penalty s.42.
AAD-RE-05 (RequestingEntity): Do not collect, use or store core biometric information. Breach: Collecting, using, storing or sharing core biometric information. Penalty: Sharing/using core biometric information in contravention of s.29 -> s.38 (up to 10 years and fine not less than Rs.10 lakh) / s.37 (disclosure); plus civil penalty up to Rs.1 crore (s.33A).
(Aadhaar number holder) Request correction of incorrect information.
(Authority / requesting entities) Maintain authentication records for the prescribed period; provide access to the individual.
AAD-RE-04 (RequestingEntity): Maintain authentication records for the prescribed period. Breach: Failure to maintain authentication records for the prescribed period. Penalty: Civil penalty up to Rs.1 crore per contravention plus up to Rs.10 lakh/day continuing (s.33A, adjudicated u/s 33B); residual general penalty s.42.
Identity information/authentication records may be disclosed only pursuant to an order of a court not inferior to a High Court Judge, or on a direction (reviewed by an Oversight Committee) in the interest of national security; core biometric information shall not be disclosed.
Comply with the Act, rules, regulations and the Authority's directions; furnish information when required.
The Authority appoints an Adjudicating Officer (not below Joint Secretary) to hold an inquiry and impose the civil penalty under s.33A, after an opportunity of hearing.
An appeal against an order of the Adjudicating Officer lies to the Appellate Tribunal.
Provides for the procedure and powers of the Appellate Tribunal.
An appeal against an order of the Appellate Tribunal lies to the Supreme Court.
No civil court has jurisdiction over matters that the Adjudicating Officer or the Appellate Tribunal is empowered to determine.
Impersonating another (by false demographic/biometric information) at enrolment is an offence.
Changing an Aadhaar number holder's demographic/biometric information with intent to harm or appropriate identity is an offence.
Pretending to be authorised to collect identity information, without authorisation, is an offence.
Do not disclose identity information to any unauthorised person or in breach of the applicable agreement.
Do not access or interfere with the CIDR without authorisation; report and remediate any unauthorised access.
AAD-RE-06 (RequestingEntity): Report and remediate unauthorised access. Breach: Failure to report and remediate an unauthorised access to, or breach of, identity information. Penalty: Unauthorised access -> s.38 (up to 10 years and fine not less than Rs.10 lakh); tampering with CIDR data -> s.39 (up to 10 years); plus civil penalty up to Rs.1 crore (s.33A).
Do not tamper with data in the CIDR.
AAD-RE-06 (RequestingEntity): Report and remediate unauthorised access. Breach: Failure to report and remediate an unauthorised access to, or breach of, identity information. Penalty: Unauthorised access -> s.38 (up to 10 years and fine not less than Rs.10 lakh); tampering with CIDR data -> s.39 (up to 10 years); plus civil penalty up to Rs.1 crore (s.33A).
(Requesting / offline verification-seeking entity) Use identity information only as permitted by s.8(2)/s.8A(2).
(Enrolling agency / requesting entity) Comply with the intimation duties in s.3(2)/s.8(3).
Any contravention of the Act, rules or regulations for which no specific penalty is provided is punishable under this general penalty.
(Company officers) Exercise due diligence to prevent commission of an offence.
The Act applies to offences/contraventions committed outside India involving a computer/system located in India.
Provides for the investigation of offences by a police officer not below the rank of Inspector.
Penalties under this Act are without prejudice to punishment under any other law.
A court shall take cognizance of an offence only on a complaint made by the Authority or an officer/person authorised by it; only a court not inferior to a Court of Sessions may try such offences.
The Central Government may, in specified circumstances, supersede the Authority.
Members, officers and employees of the Authority are deemed public servants.
The Central Government may issue directions to the Authority on policy matters.
Exempts the income of the Authority from tax.
The Authority may delegate its powers and functions.
No suit or proceeding lies against the Government/Authority/officers for anything done in good faith.
Comply with the rules made under s.53.
Comply with the regulations made under s.54.
Rules and regulations must be laid before each House of Parliament.
The Act's provisions are in addition to, and not in derogation of, other laws.
Section 57 (which permitted use of Aadhaar by the State or any body corporate/person under any law or contract) was struck down by the Supreme Court in K.S. Puttaswamy (2018) and stands omitted.
The Central Government may issue orders to remove difficulties within a limited period.
Validates actions taken under the earlier executive notifications relating to the UIDAI prior to the Act.
Versioned JSON endpoints. Read access is open; write/usage needs a key.
# Fetch the full law as JSON curl https://lawascode.negd.in/laac-api/v1/laws/the-aadhaar-targeted-delivery-of-financial-and-other-subsidies-benefits-and-services-act-2016 # Just the penalty schedule curl https://lawascode.negd.in/laac-api/v1/laws/the-aadhaar-targeted-delivery-of-financial-and-other-subsidies-benefits-and-services-act-2016/penalties # A specific provision curl https://lawascode.negd.in/laac-api/v1/laws/the-aadhaar-targeted-delivery-of-financial-and-other-subsidies-benefits-and-services-act-2016/provisions/1