A central database’s job is to be correct. It was never built to also be discreet about 1.4 billion people. Ask one institution to do both, and you create a single point where everything can be disclosed.

Last year I rented a flat in Bengaluru. The broker asked for my Aadhaar, as every rent agreement does. I sent a photo over WhatsApp; he forwarded it to the landlord. The landlord now has my name, photograph, date of birth, gender, permanent address, and a twelve-digit number linked to my bank accounts, SIM cards, tax records, and biometrics.

He needed to know two things: that I am who I say I am, and that I am an adult who can sign a contract. Two facts. He received a full file.

A month later, a hospital photocopied my wife's Aadhaar for a routine check and left the copy in a plastic folder on the counter, visible to the queue. It needed to know who she was for insurance purposes and that she is of legal age to consent to treatment. It received her home address.

This is not a criticism of Aadhaar. Aadhaar is the foundation that allowed over a billion people to prove their existence in the digital economy. It is, however, an analysis of a structural flaw: What happens when proving a single attribute about yourself requires surrendering your entire digital identity?

The problem here was that a document to verify one detail could not be divided.

For a decade, an Aadhaar photocopy has been the atomic unit of Indian identity verification. Hotels ask for it. So do landlords, schools, gyms, banks, courier companies, coaching centres and the man at the gate of an office park.

The trouble is that the card is all or nothing. Every minor query demands a major disclosure. Every answer gets stored perpetually in phones, file drawers, plastic folders, and unmanaged WhatsApp chats.

These unencrypted static copies do not stay where they are dropped. The CBI's Operation Chakra-V found that more than 700 bank branches had opened around 8.5 lakh mule accounts, many without proper KYC. Somewhere in that pipeline is a photocopy that was collected for one purpose and reused for another.

India has done what no other country has. It gave a billion people a digital identity. It built a payments network that moves money between strangers in seconds.

And between those two world-class systems, when a tenant meets a landlord, the check is a photo on WhatsApp. The old paper card also came with another problem; it was endlessly copyable. And many did eventually find their way into street vendor’s food packaging. 

The Regulatory Act

The current Digital Personal Data Protection (DPDP) Act is catching up. It says a business or financial institutions may collect only the personal data its purpose needs. A landlord needs a name and a yes-or-no answer on whether the tenant is over eighteen years of age. He does not need a date of birth or an address in another city. These rules start to apply from May 2027.

As a result, the UIDAI also updated their application. UIDAI's new Aadhaar app is real progress. You can share a masked number, show only the fields you choose, and prove your age with a QR code. UIDAI is also moving to end photocopying. That deserves credit.

But take a closer look at the new system. Look at who is still in the middle. UIDAI built the app, UIDAI decides which fields can be hidden, and every share still runs through UIDAI's system. Privacy is better, meaning you can share selective details with the receiving party, but it also means the central system knows every time you share it with somebody. At least in the old paper copy, the centre never knew when you copied your ID and who you gave it to.

Privacy as a feature has been achieved. Privacy by design? Still a long way to go.

A central database’s job is to be correct. It was never built to be discreet about 1.4 billion people. Ask one body to do both, and you create a single point where everything can be disclosed.

We already know a model that works: The passport.

The government issues it. But once it is in your pocket, the government is not in the room when you use it. The officer in, let’s say, Frankfurt does not call Delhi. The hotel in Lisbon does not tell the ministry. One party vouches, one carries, one checks. Nobody sees the whole picture.

Europe is building exactly this for the phone. By December, every EU country is meant to offer its citizens a digital identity wallet. To prove your age, the wallet sends a yes: over eighteen. The service learns nothing else, and the government that issued the identity never gets to know you used it.

People will argue that without routing through UIDAI every time, we become susceptible to fraud and there is no way to verify a document's authenticity without UIDAI’s real-time verification stamp.

That argument is valid. But it also means the central registry logs every single instance you present your ID. The irony is that the central agency tasked with enabling identification also becomes a global tracking engine.

The Fix? The Architecture: Centralised Verification, Local Control

A local tokenised credential that every citizen holds. Just like the old paper copy. But it stays on their phone. Securely stored. This token is created once, after validation with the central registry. 

The idea is simple. UIDAI's database already holds a biometric for every enrolled resident. When the identity is issued into the phone wallet, the central registry is called once to verify. After a successful verification, a token is created. Call it your digital identity or bio code. Now every time you need to access this code, it can only be unlocked by your biometric data (like a face or fingerprint match), so that even if your device is compromised, the token stays secure.

One call to the central database. Then the centre steps out of the room.

Here is what that looks like:

The landlord's app asks the wallet two questions. Is this person who they say they are? Are they over eighteen? The wallet answers yes and yes, with a name and a photo. Nothing else. UIDAI never learns a flat was rented.

The hospital asks one question. Is this the patient? The token answers Yes. 

A payments app onboards a customer with only what it needs, as a signed answer instead of a JPEG. There is no photocopy to file, none to lose, and none for a mule account network to reuse.

India built the registry. That was the hard part, and it is done. India has written the law that says ask only for what you need.

What is missing is the link between them. An identity that UIDAI issues once, that lives on your phone, that opens only for your face, and that answers with a yes or a no instead of a file.

The author is India-Head, Identity.io. Views expressed are personal.