Do’s and Don’ts for OVSEs

## Report on UIDAI Circular No. 1503542021AUHQ: Aadhaar Usage Dos and Don'ts for Offline Verification Seeking Entities (OVSEs) **1. Executive Summary:** This report analyzes UIDAI Circular No. 1503542021AUHQ, dated October 31st, 2022, concerning the appropriate usage of Aadhaar for offline verification by Offline Verification Seeking Entities (OVSEs). This is a *new* policy guidance, establishing rules for how OVSEs handle Aadhaar data during offline verification. The core purpose of this circular is to ensure the security, confidentiality, and lawful use of Aadhaar data during offline verification processes, and to prevent misuse while providing alternative identification means. Key findings emphasize the mandatory verification of digital signatures, obtaining explicit consent, and restrictions on data storage post-verification. **2. Introduction:** This report aims to provide a comprehensive overview of UIDAI Circular No. 1503542021AUHQ, focusing on the guidelines for Offline Verification Seeking Entities (OVSEs) regarding Aadhaar usage for offline verification purposes. The analysis is based solely on the information provided within the circular text. **3. Policy Overview:** * Core Objective(s) as stated or inferred from the provided text: * To regulate the use of Aadhaar for offline verification by OVSEs. * To ensure the security and confidentiality of Aadhaar data during offline verification. * To ensure lawful use of Aadhaar with explicit consent from the Aadhaar holder. * To prevent denial of services based solely on the inability to undergo Aadhaar verification. **4. Background and Rationale:** As a new policy, this circular likely addresses the need for clear guidelines and standardization in the offline verification of Aadhaar. The rapid adoption of Aadhaar for various services necessitates a framework to prevent misuse, unauthorized storage, and ensure adherence to the Aadhaar Act and related regulations. This policy intends to reduce security vulnerabilities that might arise from insecure offline verification processes, such as data breaches or identity theft. **5. Key Provisions / Changes:** This circular establishes the following requirements for OVSEs: * **Verification Mandate:** OVSEs *must* carry out offline verification of Aadhaar via Secure QR Code or Paperless Offline eKYC XML before accepting it as proof of identity. They must validate the UIDAI's digital signature. * **Consent Requirement:** Explicit consent (physical or electronic) *must* be obtained from the Aadhaar holder for offline verification, and logs/records of consent *must* be maintained. * **Alternative Identification:** OVSEs *must* provide alternative means of identification in addition to Aadhaar. * **Data Security:** Aadhaar data collected *cannot* be shared with any entity except in accordance with the Aadhaar Act. * **Service Denial Prohibition:** Service *cannot* be denied if a resident refuses or is unable to undergo Aadhaar verification, provided they can identify themselves through alternative means. * **Cooperation with Authorities:** OVSEs *must* fully cooperate with the UIDAI or authorized agencies in fraud investigations. * **Reporting Misuse:** OVSEs *must* inform the UIDAI and the Aadhaar holder of any misuse or compromise of Aadhaar-related information within 72 hours. * **Compliance:** OVSEs *must* strictly comply with the Aadhaar Act and any directions from UIDAI. * **Data Handling Restrictions:** OVSEs cannot collect, use, or store Aadhaar number or biometric information after offline verification. If storing a copy of Aadhaar is necessary, the Aadhaar number *must* be redacted (masked and irretrievable). * **Prohibitions:** OVSEs *cannot* accept Aadhaar without verifying the digital signature, perform verification without explicit consent, or perform offline verification on behalf of another entity. **6. Target Audience and Stakeholders:** The primary target audience and stakeholders are Offline Verification Seeking Entities (OVSEs). These include businesses, organizations, and government agencies that utilize Aadhaar for identity verification and KYC processes in an offline setting. The Aadhaar number holders are indirectly affected as the policy aims to protect their data and ensure they are not denied services solely based on Aadhaar verification. **7. Implementation Aspects (Inferred):** * **Responsible agency/bodies mentioned:** The Unique Identification Authority of India (UIDAI) is the responsible body. * **Timelines or procedures specified:** The circular specifies a 72-hour timeframe for reporting any misuse or compromise of Aadhaar-related information. The procedure for offline verification involves using the Aadhaar Secure QR code scanner application or the mAadhaar application, both freely available. The scanner application validates UIDAIs digital signature. **8. Expected Outcomes / Impact of Changes:** The intended outcomes of this policy are likely to be: * Increased security and confidentiality of Aadhaar data used for offline verification. * Reduced instances of Aadhaar misuse by OVSEs. * Greater awareness among OVSEs regarding their responsibilities under the Aadhaar Act and related regulations. * Enhanced protection of Aadhaar holders' rights, ensuring they are not denied services if unable to undergo Aadhaar verification. * Improved compliance with the Aadhaar Act and related guidelines. **9. Conclusion:** UIDAI Circular No. 1503542021AUHQ provides essential guidelines for Offline Verification Seeking Entities (OVSEs) regarding the appropriate and secure use of Aadhaar for offline verification. The policy emphasizes verification protocols, consent requirements, and data protection measures. By adhering to these guidelines, OVSEs can contribute to a more secure and trustworthy Aadhaar ecosystem, protecting the privacy and rights of Aadhaar holders. The circular's significance lies in its attempt to formalize and standardize offline Aadhaar verification processes, thereby mitigating potential risks associated with data security and misuse.

Key Entities Referenced