---
layout: default
title: "UIDAI Practices and the Information Technology Act, Section 43A and Subsequent Rules"
description: "A February 2014 CIS post by Elonnai Hickok examining UIDAI practices against Section 43A of the Information Technology Act and the Information Technology Reasonable Security Practices and Procedures and Sensitive Personal Data or Information Rules, 2011, using publicly available UIDAI documents and the Aadhaar enrolment form."
authors: ["Elonnai Hickok"]
categories: [Centre for Internet and Society, Elonnai Hickok]
date: 2014-02-25
source: "Centre for Internet and Society"
permalink: /elonnai/uidai-practices-and-the-information-technology-act-section-43a-and-subsequent-rules/
page_id: TSAP-1244
created: 2026-08-29
homepage_featured: true
---

**"UIDAI Practices and the Information Technology Act, Section 43A and Subsequent Rules"** is a policy post by [Elonnai Hickok](/elonnai/) published by the [Centre for Internet and Society](/cis/) on 25 February 2014. It explains the requirements under Section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and examines publicly available UIDAI documents and the Aadhaar enrolment form against those requirements.

## Contents

1. [Article Details](#article-details)
2. [Full Text](#full-text)
3. [Context and Background](#context-and-background)
4. [External Link](#external-link)

## Article Details

<dl class="media-details">
  <dt>📰 Published by:</dt>
  <dd><em>Centre for Internet and Society</em></dd>

  <dt>📅 Date:</dt>
  <dd>25 February 2014</dd>

  <dt>✍️ Author:</dt>
  <dd>Elonnai Hickok</dd>

  <dt>📄 Type:</dt>
  <dd>Blog post</dd>

  <dt>🗂️ Filed under:</dt>
  <dd>UID, Internet Governance, Privacy</dd>

  <dt>🔗 Original Link:</dt>
  <dd>
    <a href="https://cis-india.org/internet-governance/blog/uid-practices-and-it-act-sec-43-a-and-subsequent-rules">Read the original post</a>
  </dd>
</dl>

## Full Text

<div class="highlighted-text" id="fulltext">

<p>UIDAI practices and section 43A of the IT Act are analyzed in this post.</p>

<hr class="article-separator">

<p>In the 52<sup>nd</sup> Report on Cyber Crime, Cyber Security, and the Right to Privacy – in evidence provided, the Department of Electronics and Information Technology stated "...Section 43A and the rules published under that Section cover the entire privacy in case of digital data. These are being followed by UIDAI also and other organisations..." (pg.46) <sup id="ref-1"><a href="#note-1">1</a></sup></p>

<p>This blog post explains the requirements found under Section 43A of the Information Technology Act 2000 and the subsequent Information Technology "Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011<sup id="ref-2"><a href="#note-2">2</a></sup> and analyses publicly available documents from the UIDAI website<sup id="ref-3"><a href="#note-3">3</a></sup> as well as the UIDAI enrolment form<sup id="ref-4"><a href="#note-4">4</a></sup> to demonstrate the ways in which:</p>

<ul>
<li>UIDAI practices are in line with section 43A and the Rules,</li>
<li>UIDAI practices are not in line with section 43A and the Rules,</li>
<li>UIDAI practices are partially in with section 43A and the Rules</li>
<li>Where more information is needed to draw a conclusion.</li>
</ul>

<h3>Applicability and Scope</h3>

<p>Section 43A of the Information Technology Act 2008 and subsequent Rules apply only to Body Corporate and to digital information.</p>

<p>Body Corporate under the Information Technology Act 2008 is defined as:</p>

<p>"Any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities"</p>

<p><strong>UIDAI Practices - not in line:</strong> The UIDAI is not a body corporate. The UIDAI is an attached office under the aegis of the Planning Commission that was set up by an executive order.<sup id="ref-5"><a href="#note-5">5</a></sup></p>

<p>The UIDAI collects, processes, stores, and shares both digital and non-digital information. As section 43A and subsequent Rules apply only to digital information, there is not sufficient protection provided over all the information collected, processed, stored, and used by the UIDAI.</p>

<h3>Privacy Policy on Website</h3>

<p>Rule 4 requires body corporate to provide a privacy policy on their website. The privacy policy must include:</p>

<ul>
<li>Clear and easily accessible statements of its practices and policies</li>
<li>Type of personal or sensitive personal data or information collected</li>
<li>Purpose of collection and usage of such information</li>
<li>Disclosure of information including sensitive personal information</li>
<li>Reasonable security practices and procedures as provided under rule 8</li>
</ul>

<p><strong>UIDAI Practices - Partially in Line</strong></p>

<ul>
<li>Though the UIDAI has placed a privacy policy<sup id="ref-6"><a href="#note-6">6</a></sup> on their website, the privacy policy only addresses the use of website and does not comprehensively provide clear and accessible statements about all of the UIDAI's practices and policies.</li>
<li>The UIDAI privacy policy does not state the specific types of personal or sensitive data that could be collected, but instead states "As a general rule, this website does not collect Personal Information about you when you visit the site. You can generally visit the site without revealing Personal Information, unless you choose to provide such information."</li>
</ul>

<p>Features on the UIDAI website that require individuals to provide personal information and sensitive personal information include: Booking an appointment, checking aadhaar status, enrolling for e-aadhaar, enrolling for aadhaar, updating aadhaar data. Types of information required for these services include: mobile number, name, address, gender, date of birth, and enrolment ID.<sup id="ref-7"><a href="#note-7">7</a></sup></p>

<p>The privacy policy goes on to state: "If you are asked for any other Personal Information you will be informed how it will be used if you choose to give it. If at any time you believe the principles referred to in this privacy statement have not been followed, or have any other comments on these principles, please notify the webmaster through the Contact Us page. Note: The use of the term "Personal Information" in this privacy statement refers to any information from which your identity is apparent or can be reasonably ascertained."</p>

<p>The UIDAI privacy policy does explain the purpose for collection of information on the website and the use of collected information.</p>

<p>The UIDAI privacy policy does not address the possibility of disclosure of information collected by the UIDAI from the use of its website, except in the case of when an individual provides his/her email at which point the privacy policy states "Your e-mail address will not be used for any other purpose, and will not be disclosed without your consent."</p>

<p>The UIDAI privacy policy does not provide information about the security practices adopted by the UIDAI.</p>

<h3>Consent</h3>

<p>Rule 5 requires that prior to the collection of sensitive personal data, the body corporate must obtain consent, either in writing or through fax regarding the purpose of usage before collection of such information.</p>

<p><strong>UIDAI Practices - in Line</strong></p>

<p>The UIDAI collects written consent from individuals through the enrolment form for the issuance of an Aadhaar number.</p>

<h3>Collection Limitation</h3>

<p>Rule 5 (2) requires that body corporate only collect sensitive personal data if it is connected to a lawful purpose and if it is considered necessary for that purpose.</p>

<p><strong>UIDAI Practices - in Line</strong></p>

<p>The Aadhaar enrolment form requires only the necessary sensitive personal data for the issuance of an Aadhaar number. Individuals are given the option to provide banking and financial information.</p>

<h3>Notice During Direct Collection</h3>

<p>Rule 5(3) requires that while collecting information directly from an individual the body corporate must provide the following information:</p>

<ul>
<li>The fact that the information is being collected</li>
<li>The purpose for which the information is being collected</li>
<li>The intended recipients of the information</li>
<li>The name and address of the agency that is collecting the information</li>
<li>The name and address of the agency that will retain the information</li>
</ul>

<p><strong>UIDAI Practices - Partially in Line</strong></p>

<p>The Aadhaar enrolment form does not provide the following information:</p>

<ul>
<li>The intended recipients of the information</li>
<li>The name and address of the agency collecting the information</li>
<li>The name and address of the agency that will retain the information</li>
</ul>

<h3>Retention Limitation</h3>

<p>Rule 5(4) requires that body corporate must retain sensitive personal data only for as long as it takes to fulfil the stated purpose or otherwise required under law.</p>

<p><strong>UIDAI Practices - Unclear</strong></p>

<p>It is unclear from publicly available information what the UIDAI retention practices are.</p>

<h3>Use Limitation</h3>

<p>Rule 5(5) requires that information must be used for the purpose that it was collected for.</p>

<p><strong>UIDAI Practices - Unclear</strong></p>

<p>It is unclear from publicly available information if the UIDAI is using collected information only for the purpose for which it was collected for.</p>

<h3>Right to Access and Correct</h3>

<p>Rule 5(6) requires body corporate to provide individuals with the ability to review the information they have provided and access and correct personal or sensitive personal information.</p>

<p><strong>UIDAI Practices - Partially in Line</strong></p>

<p>Though the UIDAI provides individuals with the ability to access and correct personal information, as stated on the enrolment form, correction is free only if changed within 96 hours of enrolment. Additionally, as stated on the enrolment form, if an individual chooses to allow for the UIDAI to facilitate the opening of a bank account and link present bank accounts to the UID number, this information, after being provided, cannot be corrected. The UIDAI website has a portal for updating information, but only name, address, gender, data of birth, and mobile number can be updated through this method.<sup id="ref-8"><a href="#note-8">8</a></sup></p>

<h3>Right to 'Opt Out' and Withdraw Consent</h3>

<p>Rule 5(7) requires that body corporate must provide individuals with the option of 'opting out' of providing data or information sought. Individuals also have the right to withdraw consent at any point of time. Body corporate has the right to withdraw services if consent is withdrawn.</p>

<p><strong>UIDAI Practices - Partially in Line</strong></p>

<p>The UID enrolment form provides individuals with one 'optional' field - the option of having the UIDAI open a bank account and link it to the individuals UID number or having the UIDAI link present bank accounts to individuals UID number. No other option to 'opt out' or withdraw consent is present on the enrolment form or the UIDAI privacy policy, terms of use, or website.</p>

<h3>Security of Information</h3>

<p>Rule 8 requires that body corporate must secure information in accordance with the ISO 27001 standard. These practices must be audited on an annual basis or when the body corporate undertakes a significant up gradation of its process and computer resource.</p>

<p><strong>UIDAI Practices - Unclear</strong></p>

<p>The security practices adopted by the UIDAI are not mentioned in the website privacy policy, on the website, or on the enrolment form, thus it is unclear from publicly available information if the UID is compliant with ISO 27001 standards. Though the UIDAI has been functioning since 2010, and it is unclear from publicly available information if annual audits of the UIDAI security practices have been undertaken.</p>

<h3>Disclosure with Consent</h3>

<p>Rule 6 requires that body corporate must have consent before disclosing sensitive personal data to any third person or party, except in the case with Government agencies for the purpose of verification of identity, prevention, detection, investigation, including cyber incidents and prosecution and punishment of offenses, on receipt of a written request.</p>

<p><strong>UIDAI Practices - Partially in Line</strong></p>

<p>In the enrolment form, consent for disclosure is stated as "I have no objection to the UIDAI sharing information provided by me to the UIDAI with agencies engaged in delivery of welfare services." This is a blanket statement and allows for all future possibilities of sharing and disclosure of information provided with any organization that the UIDAI deems as "engaged in the delivery of welfare services".</p>

<p>The UIDAI privacy policy only addresses the disclosure of an individual's email address with consent. Though not directly addressing disclosure, the UIDAI privacy policy also states "We will not identify users or their browsing activities, except when a law enforcement agency may exercise a warrant to inspect the service provider's logs."</p>

<h3>Prohibition on Publishing and Further Disclosure</h3>

<p>Rule 6(3) and 6(4) prohibit the body corporate from publishing sensitive personal data or information. Similarly, organizations receiving sensitive personal data are not allowed to disclose it further.</p>

<p><strong>UIDAI Practices - in Line</strong></p>

<p>The UDAI does not publish sensitive personal data. It is unclear what practices and standards registrars and enrolment agencies are functioning under.</p>

<h3>Requirements for Transfer of Sensitive Personal Data</h3>

<p>Rule 7 requires that body corporate may transfer sensitive personal data into another jurisdiction only if the country ensures the same level of protection.</p>

<p><strong>UIDAI Practices - Unclear</strong></p>

<p>It is unclear from publicly available information if information collected by the UIDAI is transferred outside of India.</p>

<h3>Establishment of Grievance Officer</h3>

<p>Rule 5(9) requires that body corporate must establish a grievance officer and the details must be posted on the body corporates website and grievances must be addressed within a month of receipt.</p>

<p><strong>UIDAI Practices - in Line</strong></p>

<p>The website of the UIDAI provides details of a grievance officer that individuals can contact.<sup id="ref-9"><a href="#note-9">9</a></sup> It is unclear from publicly available information if grievances are addressed within a month.</p>

<h3>Footnotes</h3>

<ol class="references-list">
<li id="note-1"><a href="http://164.100.47.134/lsscommittee/Information%20Technology/15_Information_Technology_52.pdf">164.100.47.134 — 52nd Report on Cyber Crime, Cyber Security, and the Right to Privacy</a><a href="#ref-1" aria-label="Return to reference 1">↩</a></li>
<li id="note-2"><a href="http://dispur.nic.in/itact/it-procedures-sensitive-personal-data-rules-2011.pdf">dispur.nic.in — Information Technology Rules 2011</a><a href="#ref-2" aria-label="Return to reference 2">↩</a></li>
<li id="note-3"><a href="http://uidai.gov.in/">uidai.gov.in</a><a href="#ref-3" aria-label="Return to reference 3">↩</a></li>
<li id="note-4"><a href="http://www.jharkhand.gov.in/marpdf/Aadhar-enrolmentform.pdf">jharkhand.gov.in — Aadhar enrolment form</a><a href="#ref-4" aria-label="Return to reference 4">↩</a></li>
<li id="note-5"><a href="http://uidai.gov.in/organization-details.html">uidai.gov.in — Organisation details</a><a href="#ref-5" aria-label="Return to reference 5">↩</a></li>
<li id="note-6"><a href="http://uidai.gov.in/privacy-policy.html">uidai.gov.in — Privacy policy</a><a href="#ref-6" aria-label="Return to reference 6">↩</a></li>
<li id="note-7"><a href="http://resident.uidai.net.in/home">resident.uidai.net.in — UIDAI resident portal</a><a href="#ref-7" aria-label="Return to reference 7">↩</a></li>
<li id="note-8"><a href="https://ssup.uidai.gov.in/web/guest/ssup-home">ssup.uidai.gov.in — Self Service Update Portal</a><a href="#ref-8" aria-label="Return to reference 8">↩</a></li>
<li id="note-9"><a href="http://uidai.gov.in/contactus.html">uidai.gov.in — Contact us</a><a href="#ref-9" aria-label="Return to reference 9">↩</a></li>
</ol>

<p><em>The views and opinions expressed on this page are those of their individual authors. Unless the opposite is explicitly stated, or unless the opposite may be reasonably inferred, CIS does not subscribe to these views and opinions which belong to their individual authors. CIS does not accept any responsibility, legal or otherwise, for the views and opinions of these individual authors. For an official statement from CIS on a particular issue, please contact us directly.</em></p>

</div>

{% include back-to-top.html %}

## Context and Background

In February 2014, the Centre for Internet and Society (CIS) published Elonnai Hickok's analysis of UIDAI practices against Section 43A of the Information Technology Act and the 2011 Rules on reasonable security practices and sensitive personal data. The post was written in the context of evidence before the Parliamentary Standing Committee's 52nd Report on Cyber Crime, Cyber Security, and the Right to Privacy, in which the Department of Electronics and Information Technology stated that Section 43A and its rules covered privacy in digital data and were being followed by UIDAI and other organisations.

The article takes that claim and tests it against publicly available UIDAI materials, including the organisation's website, privacy policy and Aadhaar enrolment form. It first argues that UIDAI did not fall within the definition of a "body corporate" used in Section 43A, and that the rules applied only to digital information, leaving non-digital information outside their scope.

The analysis then works requirement by requirement. It finds UIDAI practices in line with the rules on written consent, collection limitation, prohibition on publishing sensitive personal data and establishment of a grievance officer. It finds practices partially in line on the website privacy policy, direct-collection notice, access and correction, opting out and withdrawal of consent, and disclosure with consent. It describes retention, use limitation, security practices, and cross-border transfer as unclear from publicly available information.

The article's assessment is therefore not a blanket finding of compliance. Instead, it separates areas where the available documents support a conclusion from areas where information was missing, while highlighting gaps in the privacy policy and enrolment form, including the absence of specified recipients and retaining-agency details and the lack of stated security practices.

## External Link

- [UIDAI Practices and the Information Technology Act, Section 43A and Subsequent Rules](https://cis-india.org/internet-governance/blog/uid-practices-and-it-act-sec-43-a-and-subsequent-rules) on CIS website

{% include navbox-elonnai.html %}

<style>
.media-details {
  background: #f9fbfe;
  border: 1px solid #d8e2f0;
  border-radius: 10px;
  padding: 1.2rem 1.4rem;
  max-width: 700px;
  margin: 1.2rem auto;
  font-size: 0.96rem;
  line-height: 1.5;
  color: #333;
  box-shadow: 0 2px 4px rgba(0,0,0,0.04);
}
.media-details dt {
  font-weight: 600;
  color: #1b2a49;
  margin-top: 0.7rem;
}
.media-details dd {
  margin: 0 0 0.3rem 0.3rem;
  color: #555;
}
.highlighted-text {
  background-color: #fffbea;
  border-left: 4px solid #f2ce61;
  padding: 1rem 1.2rem;
  border-radius: 8px;
  line-height: 1.65;
  color: #333;
  box-shadow: 0 1px 3px rgba(0,0,0,0.05);
  margin-bottom: 0.8rem;
  overflow-wrap: break-word;
}
.highlighted-text p {
  margin-bottom: 1rem;
}
.highlighted-text ul,
.highlighted-text ol {
  margin: 0 0 1rem 1.5rem;
}
.article-separator {
  border: none;
  border-top: 1px solid rgba(0,0,0,0.08);
  margin: 0.75rem 0 1rem 0;
}

.references-list {
  margin: 0 0 1rem 1.5rem;
  word-break: break-word;
  overflow-wrap: break-word;
}

.references-list li {
  margin-bottom: .8rem;
  overflow-wrap: break-word;
  word-break: break-word;
}

.references-list li a {
  word-break: break-all;
  overflow-wrap: break-word;
  display: inline-block;
  max-width: 100%;
}

.references-list li:last-child {
  margin-bottom: 0;
}

.references-list a[href^="#ref-"] {
  margin-left: .35rem;
  text-decoration: none;
  word-break: normal;
  display: inline;
}

@media (max-width: 480px) {
  .references-list {
    font-size: 0.85rem;
    padding-left: 1.1rem;
  }
  .references-list li {
    margin-bottom: 1rem;
    line-height: 1.5;
  }
  .highlighted-text {
    padding: 0.85rem 1rem;
    font-size: 0.94rem;
  }
}
</style>