# Aadhaar (UIDAI) compliance: Aadhaar Act, 2016 and UIDAI authentication regulations for AUAs and KUAs

> Security and audit obligations for organisations using Aadhaar authentication and e-KYC.

URL: https://securei3.com/standards/uidai-aadhaar/
Category: India regulations: Law or regulation
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


Organisations authorised by UIDAI as Authentication User Agencies (AUAs) or e-KYC User Agencies (KUAs), and their sub-AUAs, must follow the Aadhaar Act, 2016, UIDAI regulations and specifications. Key obligations include consent and purpose limitation, storing Aadhaar numbers only in an Aadhaar Data Vault, use of hardware security modules, logging, and annual information security audits by CERT-In empanelled auditors.

We assess Aadhaar-related systems and processes, help design the data vault and key management, and prepare you for the UIDAI audit.

## Who it is for

- Banks, NBFCs, telecom and insurance companies using Aadhaar e-KYC
- Sub-AUAs and technology service providers

## Benefits

- Audit-ready Aadhaar handling
- Lower risk of licence suspension

## How Secure iQube helps

1. **Applicability and scoping**: Confirm whether and how the law applies to you, entities, data, systems, roles and territories.
2. **Data and process mapping**: Build a record of processing or control inventory so obligations can be tied to real systems and owners.
3. **Gap assessment**: Measure current practice against each obligation and rank the gaps by legal and business risk.
4. **Remediation roadmap**: Policies, notices, contracts, technical controls and governance, sequenced so the highest risks close first.
5. **Evidence and ongoing monitoring**: A compliance calendar, metrics and periodic reviews so you can demonstrate compliance to a regulator or customer at any time.

## Frequently asked questions

### Can we store Aadhaar numbers in our main database?

No. Aadhaar numbers must be stored in a separate, secured Aadhaar Data Vault with reference keys used elsewhere, as UIDAI specifies.

Related: https://securei3.com/standards/rbi-kyc-master-direction/, https://securei3.com/standards/india-dpdp/, https://securei3.com/standards/cert-in-directions/

Contact: https://securei3.com/contact/: info@securei3.com