Do’s and Don’ts for REs

## Aadhaar Usage Policy: Dos and Don'ts for Requesting Entities - Policy Analysis Report **1. Executive Summary:** This report analyzes a circular issued by the Unique Identification Authority of India (UIDAI) regarding the usage of Aadhaar and the "Dos and Don'ts" for Requesting Entities (REs). The policy focuses on ensuring responsible and secure use of Aadhaar authentication services by these entities. It emphasizes resident privacy, data security, informed consent, and compliance with the Aadhaar Act, 2016. Key findings include the detailed guidelines for REs pertaining to Aadhaar data handling, security protocols, and ethical responsibilities. This is a new policy outlining the expectations of Requesting Entities when handling Aadhaar data. **2. Introduction:** This report aims to provide a comprehensive overview of the UIDAI circular dated October 31st, 2022, concerning the usage of Aadhaar and associated guidelines for Requesting Entities (REs). The analysis is based solely on the provided text. **3. Policy Overview:** * **Core Objective(s):** The core objectives, as inferred from the text, are to: * Ensure the secure and confidential use of Aadhaar numbers during authentication. * Protect the privacy of Aadhaar number holders. * Establish clear guidelines for REs regarding data handling, storage, and sharing. * Promote ethical and responsible use of Aadhaar authentication services. * Ensure compliance with the Aadhaar Act, 2016, and its associated regulations. **4. Background and Rationale:** The policy addresses the potential risks associated with the widespread use of Aadhaar authentication services. These risks include data breaches, privacy violations, and unauthorized access to sensitive information. By establishing clear "Dos and Don'ts," the policy aims to mitigate these risks and ensure that REs handle Aadhaar data responsibly and in compliance with relevant regulations. The policy promotes responsible behavior and reduces the risk to individuals. **5. Key Provisions / Changes:** As a New Policy, the following are the key rules and actions mandated: * **Courtesy and Security:** REs must be courteous to residents and assure them of the security and confidentiality of their Aadhaar number. * **Informed Consent:** REs must ensure that residents clearly understand the type of data being collected and the purpose of Aadhaar authentication, obtaining informed consent before authentication. * **Data Storage:** Aadhaar numbers must only be stored if authorized and within a secure Aadhaar Data Vault as prescribed by UIDAI. * **Data Sharing:** Aadhaar data cannot be shared with any entity except as permitted by the Aadhaar Act and regulations. * **Transaction Logs:** Authentication transaction logs, including consent records, must be retained only for the period prescribed under Aadhaar regulations and purged upon expiry. * **Device Hygiene:** Authentication devices must be maintained to minimize authentication failures. * **Operator Training:** Regular training must be provided to staff on best practices and safeguards. * **Suspicious Activity Reporting:** Any suspicious activity around authentication must be immediately reported to UIDAI. * **Audit Cooperation:** REs must cooperate with UIDAI and its agencies during security process audits and address any non-compliances promptly. * **Grievance Handling:** An effective grievance handling mechanism must be provided to residents through multiple channels. * **Statutory Obligations:** REs must fulfill all statutory obligations under the Aadhaar Act, 2016, including penalties for contraventions. * **Unlawful Actions:** REs must not aid or abet any unlawful actions that violate laws, regulations, or prescribed processes. * **Authentication Keys and License:** REs must not share their authentication keys, certificates, or unique license keys with any other entity. * **Aadhaar Copies:** REs must not store photocopies of Aadhaar letters without masking the first 8 digits of the Aadhaar number. * **Biometric Information:** REs must not store, share, or publish biometric information collected from the Aadhaar number holder. * **Compliance with Aadhaar Act:** REs must not act in contravention of the Aadhaar Act, 2016, and its regulations. **6. Target Audience and Stakeholders:** The primary target audience is Requesting Entities (REs) engaged in providing Aadhaar authentication services. This includes government and private legal entities registered in India that are authorized to use UIDAI's authentication services. Ultimately, Aadhaar number holders also benefit from the enhanced security and privacy measures outlined in the policy. **7. Implementation Aspects (Inferred):** * **Responsible agency/bodies:** UIDAI is the responsible agency for overseeing and enforcing the policy. Authentication Service Agencies (ASAs) facilitate authentication services to REs. * **Timelines or procedures:** The text specifies timelines for retaining and purging authentication transaction logs, referencing the Aadhaar Authentication and Offline Verification Regulations. It also implies a process for security audits by UIDAI or its designated agencies. **8. Expected Outcomes / Impact of Changes:** The likely intended outcomes of this policy are: * Increased security and confidentiality of Aadhaar data. * Enhanced protection of resident privacy. * Reduced risk of data breaches and unauthorized access. * Improved compliance with the Aadhaar Act, 2016, and its regulations. * Greater transparency and accountability in Aadhaar authentication processes. * Increased trust and confidence among Aadhaar number holders. **9. Conclusion:** The UIDAI circular outlining the "Dos and Don'ts" for Requesting Entities is a significant step towards promoting responsible and secure use of Aadhaar authentication services. The policy establishes clear guidelines for REs, emphasizing data security, privacy protection, informed consent, and compliance with the Aadhaar Act. Adherence to these guidelines is crucial for maintaining the integrity of the Aadhaar ecosystem and safeguarding the privacy of Aadhaar number holders. This policy provides much needed clarity to Requesting Entities on best practices.

Key Entities Referenced