Technology

India Stack explained: Aadhaar, UPI, DigiLocker and beyond

India Stack is the set of public digital rails for identity, payments and data that most Indian apps now plug into. Here is what each layer does, how companies build on it, and where the privacy fights and criticisms lie.

Chander Prakash

By Founder & Editor

11 min read

Illustrative cover: India Stack explained: Aadhaar, UPI, DigiLocker and beyond
Illustration: Pointales

India Stack is the name for a set of digital systems, mostly built or backed by the Indian government, that let any app verify who you are (Aadhaar), move money instantly (UPI) and share your documents or financial data with your consent (DigiLocker and Account Aggregators). They are “rails”, not apps: PhonePe, a bank, a broker or a lender builds the product you see, and the stack does the plumbing underneath. That is why opening a demat account or getting a small loan on your phone can now take minutes rather than days.

What “digital public infrastructure” means

The government describes India Stack as part of India’s digital public infrastructure (DPI). A PIB Research explainer from March 2026 cites the United Nations definition of DPI as “a set of foundational digital systems” that enable secure interaction between people, businesses and governments, such as verifying identity, opening bank accounts, making payments and exchanging data (PIB).

The idea is closer to a road network than to a company. A road is built once, to common standards, and anyone can drive on it. DPI works the same way: one shared identity system, one shared payment protocol, and published rules so that any licensed company can connect.

The volunteer technology group iSPIRT, which runs indiastack.org, describes India Stack as “a set of open APIs and digital public goods” that unlock “identity, data, and payments at population scale” (indiastack.org). An API (application programming interface) is simply a standard way for one piece of software to ask another for something, such as “is this OTP correct for this Aadhaar number?”.

The same PIB note says India had signed agreements with 24 countries on India Stack and DPI cooperation as of February 2026 (PIB).

The layers at a glance

India Stack is usually described as three layers, identity, payments and data, with “open networks” such as ONDC added more recently.

LayerComponentWhat it doesWho runs or regulates itLatest official scale
IdentityAadhaar and eKYCProves you are who you say you are, onlineUIDAI144 crore+ Aadhaar numbers generated (March 2026)
IdentityeSignLets you sign documents online using Aadhaar eKYCController of Certifying Authorities (MeitY)Not published in sources used
PaymentsUPIInstant bank-to-bank payments from any appNPCI, under RBI oversight2,407 crore transactions in September 2026
DataDigiLockerWallet for government-issued documentsMeitY72.43 crore registered users (August 2026)
DataAccount AggregatorConsent-based sharing of financial dataRBI-licensed NBFC-AAs; Sahamati as industry body17 operational AAs; 295 million+ monthly data shares (June 2026)
Open networksONDCLets any buyer app reach any seller appONDC, a Section 8 company backed by DPIIT218 million transactions in FY2025-26
Health (historical)CoWINRan COVID-19 vaccine registration and certificatesHealth ministry220 crore+ doses managed

Sources for each figure are given in the sections below.

Identity: Aadhaar, eKYC and eSign

Aadhaar is a 12-digit number linked to a person’s fingerprints, iris scan and face photo, issued by the Unique Identification Authority of India (UIDAI). UIDAI was formed in 2009 and the first Aadhaar was issued in 2010 (indiastack.org). As of March 2026, more than 144 crore Aadhaar numbers had been generated, and over 2,707 crore authentication transactions were carried out in 2024-25 alone (PIB).

Two uses matter most for the rest of the stack:

  • Authentication answers a yes/no question: does this fingerprint, face or OTP match this Aadhaar number?
  • eKYC (electronic Know Your Customer) goes one step further. With your consent, UIDAI sends the requesting bank or company your verified name, address, date of birth and photo, so it does not need photocopies.

iSPIRT says eKYC, launched in 2012, cut the cost of a KYC check for banks from about $23 to about $0.15 (indiastack.org). That figure is the group’s own estimate, but the direction is not in dispute: paper KYC was slow and expensive.

eSign builds on eKYC. Normally a legally valid digital signature needs a certificate on a physical USB token. eSign, run under licensed certifying authorities regulated by the Controller of Certifying Authorities, verifies you through Aadhaar eKYC (by OTP or biometrics), creates a short-lived signing key, signs the document and then destroys the key (CCA). It is what lets you sign a loan agreement or a mutual fund form on your phone.

Payments: UPI

The Unified Payments Interface was launched on 11 April 2016 by the National Payments Corporation of India (NPCI) under the Reserve Bank of India’s oversight. In FY2025-26 it handled about 24,162 crore transactions worth roughly ₹314 lakh crore, and accounted for 85% of India’s digital payments, according to a Ministry of Finance release (PIB). In September 2026 alone, UPI processed 24.07 billion (2,407 crore) transactions worth ₹29.37 lakh crore, per NPCI data reported by DD News (DD News).

UPI is a protocol, not an app. Your bank holds the money; apps such as PhonePe, Google Pay or Paytm are the front end; NPCI runs the switch in the middle. The same release notes that the IMF has recognised UPI as the world’s largest real-time payment system by volume, and that it is accepted in eight countries (PIB).

How a payment actually moves, and who pays for a system that charges users nothing, is covered in our guide to how UPI works and who pays for it. Its scale has also made it a target for scams, explained in how UPI frauds work.

Data: DigiLocker and Account Aggregators

The third layer is about moving data from where it sits to where you need it, with your permission.

DigiLocker, launched by MeitY in 2015, is a digital wallet for documents such as driving licences, vehicle registrations, mark sheets and Aadhaar. Its key feature is that documents can be “issued” directly by the department that created them, so the receiver can trust they have not been edited (PIB). In August 2026, IT minister Ashwini Vaishnaw told the Rajya Sabha that DigiLocker had more than 72.43 crore registered users, and that 5,437 document types and services were available on it as of 31 July 2026 (Free Press Journal).

Account Aggregators (AAs) do the same for financial data. Suppose a lender wants six months of your bank statements. Instead of you downloading PDFs, an AA fetches them from your bank and passes them to the lender, but only after you approve a specific consent request.

The RBI created this licence category in a Master Direction dated 2 September 2016 (RBI). Three of its rules explain the design:

  • An AA can act only on the customer’s explicit consent.
  • The financial information “shall not be the property of the Account Aggregator”, and none of it may reside with the AA. The AA is a pipe, not a database.
  • An AA cannot run any other business, so it has no incentive to mine the data it carries.

In this system, banks and other data holders are Financial Information Providers (FIPs) and lenders, insurers or brokers that receive the data are Financial Information Users (FIUs). According to Sahamati, the industry body for the ecosystem, 17 Account Aggregators were operational and the network handled more than 295 million data shares a month as of June 2026 (Sahamati).

How companies must treat personal data more generally, including the consent managers created by India’s new privacy law, is covered in India’s DPDP Act explained.

Open networks: ONDC

The newest addition applies the UPI idea to shopping and services. The Open Network for Digital Commerce (ONDC), launched in 2022 as a DPIIT initiative, lets a buyer using one app order from a seller listed on a completely different app, using a shared protocol (PIB). ONDC says it enabled 218 million transactions in FY2025-26, across retail, logistics, mobility and financial services (ONDC).

Its retail side has had a harder time than its transport side. The full picture, including how an order flows, is in ONDC explained.

CoWIN: a historical example

CoWIN, launched on 16 January 2021, was the platform behind India’s COVID-19 vaccination drive, handling registration, slot booking and certificates for more than 220 crore doses (PIB). It is a useful illustration of the stack in action: identity checks, a central registry and downloadable digital certificates that could be stored in DigiLocker. The government later offered CoWIN to other countries as open-source software (PIB).

How private companies build on it

The stack is designed so that the government builds the rails and private companies build the trains. In practice:

  1. Fintech and banking apps use Aadhaar eKYC to open accounts and eSign to execute agreements without paper.
  2. Payment apps such as PhonePe and Google Pay do not hold your money; they connect to UPI through partner banks and compete on user experience.
  3. Lenders act as FIUs on the Account Aggregator network to pull verified bank data, then use it to decide on a loan.
  4. Brokers, insurers and employers pull verified documents from DigiLocker during onboarding.
  5. Shopping, food and mobility apps join ONDC as buyer or seller apps rather than building a full marketplace alone.

The upside for companies is that they do not need to build identity checks or payment networks themselves. The trade-off is that they depend on public systems they do not control, and on rules that can change, such as UPI’s zero-fee pricing.

Privacy and the Supreme Court

India Stack’s legal foundations were shaped by two Supreme Court judgments in the same case, Justice K.S. Puttaswamy (Retd.) v. Union of India.

2017: privacy is a fundamental right. On 24 August 2017, a nine-judge bench unanimously held that the right to privacy is guaranteed by the Constitution, under Article 21 and Part III as a whole (Supreme Court Observer). Any state intrusion into privacy now has to pass tests of legality, necessity and proportionality.

2018: Aadhaar upheld, with limits. On 26 September 2018, a five-judge bench upheld the Aadhaar Act by a 4:1 majority, but struck down parts of it (Supreme Court Observer). The majority read down Section 57, which had let private companies demand Aadhaar authentication, and struck down mandatory linking of Aadhaar with bank accounts and SIM cards. Justice D.Y. Chandrachud dissented, holding that the Act should not have been passed as a Money Bill (Supreme Court Observer).

2019: voluntary use. Parliament then passed the Aadhaar and Other Laws (Amendment) Act, 2019, allowing Aadhaar to be used on a voluntary basis for KYC when opening bank accounts and getting mobile connections, with penalties for private entities that misuse Aadhaar data (Business Standard). This is why a bank can offer Aadhaar eKYC but should not insist on it.

2023 onwards: a general privacy law. The Digital Personal Data Protection Act, 2023, and its 2025 Rules now set general duties for anyone handling digital personal data, with most obligations due to take effect in May 2027. See India’s DPDP Act explained.

The main criticisms

Official material on India Stack is overwhelmingly positive. The serious criticisms, with sources, are these:

  • Exclusion when authentication fails. A study by economists Karthik Muralidharan, Paul Niehaus and Sandip Sukhtankar evaluated stricter biometric ID requirements in Jharkhand’s ration system. It found corruption fell, but 1.5 to 2 million legitimate beneficiaries lost access to benefits at some point during the reforms, largely because of how the transition was managed (NBER).
  • How Aadhaar became law. Justice Chandrachud’s 2018 dissent argued that passing the Aadhaar Act as a Money Bill bypassed the Rajya Sabha and was unconstitutional (Supreme Court Observer).
  • Broad exemptions for the state. The DPDP Act lets the government exempt notified state agencies from the law on grounds such as security of the State and public order. The Internet Freedom Foundation has called the 2025 Rules “too little, too vague and too late” and says they entrench the state’s power over personal data (IFF).
  • A regulator still being set up. As of 1 August 2026, LiveLaw reported that the Data Protection Board existed in law but had no appointed chairperson or members yet (LiveLaw).
  • Open does not automatically mean adopted. ONDC’s retail orders fell from 6.5 million in October 2024 to 4.6 million in February 2025 as incentives were cut, Business Standard reported (Business Standard).

None of these undo what the stack has achieved, but they show where the risks sit: at the edges, where a failed fingerprint or a vague exemption affects a real person.

What to watch next

Three dates and questions matter over the next year. The DPDP Rules’ consent manager framework starts on 13 November 2026, and most company obligations follow on 13 May 2027. In February 2026 the Supreme Court referred challenges to the DPDP Act’s amendment of the RTI Act to a larger bench, while declining to stay the law (IFF). And the Account Aggregator and ONDC networks will show whether “data” and “commerce” rails can reach the everyday scale that UPI already has.

The point: India Stack is shared public plumbing, identity through Aadhaar, payments through UPI and data through DigiLocker and Account Aggregators, on which private apps build the products people actually use. It has cut the cost of verifying people and moving money to almost nothing at national scale. Its weak spots are exclusion when systems fail, broad state exemptions in the privacy law, and a data regulator that is still being set up.

Sources

Share