Can Companies Store Aadhaar Copies? UIDAI Rules, Risks and Safer Alternatives

Almost every business in India that onboards customers asks for an Aadhaar copy at some point. Banks verify it during account opening. Insurers collect it during policy issuance. Fintechs need it for KYC. Landlords photograph it before handing over keys. The question most of these organisations never ask until a regulator does is a critical one: can companies store Aadhaar copies, and if so, under what conditions?

The short answer is that UIDAI's rules on this topic are more restrictive than most businesses realise. Storing an unmasked Aadhaar copy — even with the owner's consent — exposes your organisation to legal risk under the Aadhaar Act, 2016 and the Digital Personal Data Protection Act, 2023. This guide walks through exactly what the rules say, what the risks are, and what compliant alternatives look like in practice.

What UIDAI Says About Storing Aadhaar Copies

UIDAI has issued clear guidance on the use and storage of Aadhaar information. The key rules that affect whether and how companies can store Aadhaar copies are:

No Entity May Store Aadhaar Numbers Without Authorisation

Under the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, only authorised entities — Authentication User Agencies (AUAs) and e-KYC User Agencies (KUAs) — are permitted to use Aadhaar-based authentication. These entities must store Aadhaar numbers in a dedicated, encrypted Aadhaar data vault, not in general-purpose databases.

For everyone else — companies that are not registered AUAs or KUAs but collect Aadhaar copies as part of manual KYC — UIDAI has not explicitly authorised the retention of full Aadhaar numbers. Collecting a copy for verification at the point of onboarding and then retaining it indefinitely is a grey area that regulators are increasingly treating as non-compliant.

UIDAI's Guidance on Masked Aadhaar

UIDAI itself introduced the concept of masked Aadhaar precisely because full copies should not be circulating unnecessarily. A masked Aadhaar shows only the last four digits of the 12-digit number, with the first eight replaced by X's. UIDAI has stated that masked Aadhaar is a valid form of identity proof for most purposes — which implicitly signals that entities requesting full Aadhaar numbers for retention purposes are taking more than they need.

Purpose Limitation and Data Minimisation

Even for entities with legitimate grounds to collect Aadhaar data, both the Aadhaar Act and the DPDP Act impose a purpose limitation principle: personal data may only be collected and used for the specific purpose for which it was gathered. If you collected an Aadhaar copy to verify identity at onboarding, you cannot retain the full document indefinitely for unrelated purposes. Doing so creates an ongoing compliance exposure that grows with every passing month.

The Legal Framework: Aadhaar Act and DPDP Act

Two laws govern how Indian businesses handle Aadhaar data. Understanding both is essential before deciding whether and how your organisation stores Aadhaar copies.

Aadhaar Act, 2016

The Aadhaar Act establishes the legal basis for Aadhaar-based authentication and creates specific obligations around data security. Section 29 prohibits the sharing of identity information with anyone not authorised to receive it. Sections 37 and 38 create criminal liability for entities that use Aadhaar data in an unauthorised manner or disclose it to third parties. A company that stores a full Aadhaar copy and subsequently suffers a breach — or shares the data with a vendor without adequate controls — can face prosecution under these provisions, not just a regulatory fine.

Digital Personal Data Protection Act, 2023

The DPDP Act classifies Aadhaar numbers as personal data requiring heightened protection. Meeting the DPDP Act compliance requirements means implementing appropriate technical and organisational security measures for any personal data you hold — and Aadhaar numbers sit at the top of the sensitivity hierarchy. The Act's data minimisation principle requires organisations to collect only what is necessary; its storage limitation principle requires data to be deleted once the purpose is fulfilled. An organisation that retains full Aadhaar copies long after the onboarding process is complete will struggle to justify that retention under a DPDP Act audit.

The financial penalties under the DPDP Act are significant — up to ₹250 crore for serious violations — and the Act's enforcement machinery is designed to pursue organisations that treat compliance as optional.

Sector-Specific Rules That Add Another Layer

Beyond UIDAI and the DPDP Act, regulated sectors face additional obligations from their own regulators. Understanding these is important because sector regulators often move faster on enforcement than the central data protection framework.

RBI Guidelines for Banks and NBFCs

The Reserve Bank of India has issued KYC master directions that govern how banks and NBFCs handle identity documents including Aadhaar. These directions require financial institutions to maintain customer due diligence records in a secure manner and to implement robust data security controls. Storing unmasked Aadhaar copies in document management systems without adequate access controls is inconsistent with these requirements and risks regulatory censure during inspections.

IRDAI Guidelines for Insurers

Insurance companies collect Aadhaar copies routinely during policy issuance and claims processing. IRDAI's guidelines on information and cyber security require insurers to classify Aadhaar data as sensitive personal information and apply commensurate protection. Unmasked copies stored in general document repositories without encryption or access logging fail this standard.

SEBI Guidelines for Capital Markets

Brokers, depository participants, and investment advisors operating under SEBI regulations are subject to cybersecurity frameworks that include specific provisions on the protection of client identity data. SEBI has made clear through its circulars that client data — including Aadhaar numbers — must be stored with controls appropriate to its sensitivity.

The Real Risks of Storing Full Aadhaar Copies

Even companies that believe they have a legitimate reason to retain Aadhaar copies face substantial risks from doing so without adequate controls. These risks are not theoretical — they materialise during audits, after breaches, and in regulatory inspections.

Data Breach Exposure

An Aadhaar number is a permanent, unique identifier. Unlike a password, it cannot be changed if compromised. If a breach exposes thousands of Aadhaar numbers stored in your document management system, the affected individuals face a lifelong risk of identity fraud. Your organisation faces liability under the Aadhaar Act and the DPDP Act, potential criminal exposure for responsible officers, and reputational damage that no PR response will fully contain.

Regulatory Inspection Risk

Regulators including RBI, IRDAI, SEBI, and the Data Protection Board under the DPDP Act have the power to inspect your data handling practices. An inspection that finds thousands of unmasked Aadhaar documents stored in a system without encryption, access logging, or retention limits creates an immediate compliance finding. The corrective actions required can be disruptive and expensive — far more so than implementing proper controls from the start.

Third-Party Risk

Most organisations share documents with vendors — cloud storage providers, document management SaaS platforms, analytics vendors, and outsourcing partners. Every time an unmasked Aadhaar copy flows to a third party, your organisation creates a data sharing event that must be governed by a data processing agreement and subject to adequate security controls at the vendor. Few organisations have mapped this exposure comprehensively, and fewer still have adequate contractual protections in place.

Employee and Insider Access Risk

Unmasked Aadhaar copies stored in document repositories are typically accessible to a wide range of employees — customer service teams, operations staff, audit teams, and IT personnel. Without role-based access controls and access logging, you cannot demonstrate that access to Aadhaar data is restricted to those with a genuine need, which is a core requirement of both the Aadhaar Act and the DPDP Act.

What Penalties Can Companies Face?

The penalties for mishandling Aadhaar data are serious enough that "we didn't know" is not a viable defence. Here is what organisations that store Aadhaar copies without adequate controls are exposed to:

• Aadhaar Act, Section 37: Imprisonment of up to three years and a fine of up to ₹10,000 for using Aadhaar data in an unauthorised manner. For companies, the penalty applies to officers in charge of the conduct of the business.
• Aadhaar Act, Section 38: Imprisonment of up to ten years and a fine of up to ₹10 lakh for offences related to disclosure of identity information.
• DPDP Act: Financial penalties of up to ₹250 crore per instance of significant non-compliance, assessed by the Data Protection Board. The Act also enables the Board to order suspension of data processing activities — a sanction that could shut down core business operations.
• Sector regulators: RBI, IRDAI, and SEBI can impose their own penalties, suspend licences, and require remediation programmes that divert management attention and resources for months.

The combination of criminal liability, civil penalties, and licence risk means that the question of whether companies can store Aadhaar copies without proper controls has a clear answer: the legal exposure is unacceptable.

The Safer Alternative: Aadhaar Masking

The practical solution that allows companies to retain a usable record of identity verification without the legal exposure of a full Aadhaar copy is Aadhaar masking. Masking replaces the first eight digits of the Aadhaar number on the document image with X's, leaving only the last four digits visible. The result — "XXXX-XXXX-1234" — is enough to confirm that verification took place and to maintain an audit trail, but it contains no sensitive identifier that could be misused.

UIDAI explicitly recognises masked Aadhaar as a valid identity document. A masked Aadhaar is legally valid for most purposes where a full copy was previously required — making masking not just a compliance measure but a functionally equivalent substitute.

How Masking Reduces Your Compliance Exposure

When you store a masked Aadhaar copy rather than the full document, several of your compliance obligations become significantly easier to meet:

• Data minimisation: You are storing only what is necessary — a record of verification with partial identification — rather than a full sensitive identifier.
• Security requirements: A masked document does not require vault-level protection because it does not contain a usable Aadhaar number. Your existing document management controls become adequate for the masked copy.
• Breach impact: If a masked document is exposed in a breach, the affected individual's Aadhaar number is not compromised. The last four digits alone cannot be used for identity fraud or Aadhaar authentication.
• Third-party sharing: Masked copies shared with vendors or partners do not create the same compliance risk as full copies, because the sensitive data element has been removed.

Automating Aadhaar Masking at Scale

For organisations processing hundreds or thousands of Aadhaar documents per day — banks during account opening campaigns, insurers during renewal seasons, fintechs scaling their onboarding — manual masking is not practical. A human reviewer cannot reliably mask every document without errors, delays, or the occasional missed document that then gets stored unmasked.

AI-based Aadhaar masking APIs integrate directly into your KYC and document workflows, automatically detecting and redacting Aadhaar numbers in uploaded documents before they reach your storage layer. The document that gets stored is already masked — there is no window during which a full copy exists in your system and no dependency on a manual review step.

This approach works across document types: scanned physical cards, digital PDFs, photographed documents on mobile, and documents embedded in larger files. Automated masking handles all these formats through the same API call, removing the need for format-specific workflows or manual triage.

Building a Compliant Document Handling Policy

Masking addresses the storage risk, but a complete compliance posture also requires a policy framework that governs how Aadhaar documents are handled from collection to deletion. Here is what a compliant document handling policy for Aadhaar copies typically includes:

1. Collection limit: Collect an Aadhaar copy only when required by law or regulation for the specific process. Do not collect it as a general-purpose identity document when lighter-touch verification would suffice.
2. Mask at ingestion: Apply automated masking to every incoming Aadhaar document at the point it enters your system — before it is stored anywhere.
3. Access controls: Restrict access to masked Aadhaar documents to roles with a genuine operational need. Log every access with timestamp and user identity.
4. Retention limits: Define how long Aadhaar documents are retained based on the regulatory requirement for the process (for example, KYC records under RBI guidelines must be kept for five years after account closure). Delete or destroy documents once the retention period expires.
5. Third-party controls: Ensure that data processing agreements with vendors who handle your Aadhaar documents include data security requirements consistent with your own obligations under the DPDP Act.
6. Periodic audit: Audit your document repositories annually to confirm that no unmasked Aadhaar copies have accumulated and that retention limits are being enforced.

For organisations working through the full regulatory picture, the Aadhaar masking regulatory checklist provides a structured framework covering both technical controls and policy requirements across the major applicable regulations.

Common Misconceptions Companies Have

Several misconceptions lead companies into compliance risk around Aadhaar storage. Here are the ones that come up most often:

"We have the customer's consent, so we can store it"

Consent under the DPDP Act must be specific, informed, and limited to the stated purpose. A blanket consent to "store your documents" does not authorise indefinite retention of a full Aadhaar number for purposes beyond the original transaction. Consent is a necessary but not sufficient condition — purpose limitation and data minimisation apply regardless of consent.

"We are an authorised AUA, so we can store anything"

AUA status authorises Aadhaar-based authentication; it does not create an unlimited licence to store Aadhaar data in any form and location. AUAs must use data vaults for Aadhaar numbers and remain subject to UIDAI's storage and access controls. Scanned Aadhaar copies held outside the vault structure are a compliance gap even for AUAs.

"Masking affects the document's validity"

This is factually incorrect. UIDAI explicitly recognises masked Aadhaar as a valid identity document. The concern typically arises from internal processes that were designed around full Aadhaar copies — but those processes can be updated. Masked Aadhaar carries the same legal validity as a full copy for most verification purposes.

"Our IT team handles security, so compliance is covered"

Technical security controls and regulatory compliance are related but distinct. An organisation can have strong network security and still be non-compliant on Aadhaar storage if it lacks a data vault (for AUAs), does not mask documents, has no retention policy, or cannot demonstrate access logging. Compliance requires both technical controls and governance framework — neither alone is sufficient.

Conclusion

The question of whether companies can store Aadhaar copies does not have a simple yes or no answer — it depends on the entity type, the regulatory framework that applies, the security controls in place, and whether the storage is proportionate to the purpose. What is clear is that storing full, unmasked Aadhaar copies in general-purpose document repositories without adequate controls is non-compliant for virtually every category of business, and the legal consequences of a breach or regulatory inspection are severe.

The practical path forward is to mask every Aadhaar document at ingestion, implement a proportionate access and retention policy, and ensure that your document handling processes align with both UIDAI requirements and the DPDP Act compliance requirements that now govern personal data across every sector. Masking removes the highest-risk element — the full Aadhaar number — while preserving the audit trail your business needs.

If you are not certain whether your current Aadhaar document storage practices are compliant, an Aadhaar masking audit for your industry is the fastest way to identify gaps and close them before a regulator does it for you.