The LPG Subsidy Just Became a Biometric Test — and the DPDP Act Has Nothing to Say About It Until 2027
From 1 October, subsidised LPG needs Aadhaar biometric authentication. Over 3 crore households aren't authenticated — and DPDP won't bind until 2027.
#The LPG Subsidy Just Became a Biometric Test — and the DPDP Act Has Nothing to Say About It Until 2027
From 1 October 2026, no Indian household gets a cooking gas cylinder at the subsidised price unless someone in it has submitted a fingerprint or a face scan to an oil company's app. The Ministry of Petroleum and Natural Gas announced on 19 September that Biometric Aadhaar Authentication is now a precondition for booking a domestic LPG refill at the regulated Retail Selling Price — and by the ministry's own count, a little over 3 crore active consumers have not completed it with eleven days to go.
This is the single largest conditioning of a welfare benefit on Aadhaar biometric authentication since the PDS rollout, and it is landing in the exact window where India's data protection law is written but not yet operative. The DPDP Act 2023 is in force on paper. The obligations that would govern this processing — purpose limitation, data minimisation, retention limits, notice — commence on 13 May 2027. The Data Protection Board that would hear a grievance about it has been legally constituted since 13 November 2025 and still has no chairperson and no members. For the next eight months, the largest biometric authentication drive in the country runs in a regulatory vacuum of the government's own construction.
#What the Petroleum Ministry actually ordered
The ministry's announcement is narrow and specific, and worth reading precisely rather than through the headlines.
From 1 October 2026, a domestic LPG consumer must have completed Biometric Aadhaar Authentication (BAA) in order to book a refill at the regulated RSP with the applicable subsidy. As on 19 September 2026, 27.43 crore active domestic consumers had completed BAA — 89.9 per cent coverage, according to the ministry. That percentage implies a base of roughly 30.5 crore active domestic connections, which puts the unauthenticated remainder at a little over 3 crore households.
Authentication can be completed through three channels: at the doorstep during a refill delivery, using the delivery staff's device running the oil marketing company's app; in person at the distributor's showroom; or from home, by pairing the OMC app (Indian Oil, BPCL or HPCL) with UIDAI's Aadhaar FaceRD application and running a face scan. The Tribune reports that the self-service route runs through pmuy.gov.in/e-kyc.html, with a toll-free helpline at 1800 2333 555.
The consequence of not authenticating is where the design gets interesting. Consumers who are "unwilling or unable" to complete BAA are not cut off from cooking gas — but they must register that choice on the OMC's digital channels (website, app, WhatsApp or IVRS), after which they are supplied LPG at the applicable market price, with no subsidy, in 5 kg or 10 kg cylinders, subject to local availability. Pradhan Mantri Ujjwala Yojana beneficiaries face a recurring version of the same requirement: annual re-authentication within each financial year to qualify for the ₹300 subsidy on their eighth and ninth refills.
The stated rationale is leakage control. Linking each connection to an Aadhaar-authenticated person, the ministry argues, prevents diversion of subsidised domestic cylinders into commercial and industrial use, removes duplicate and ineligible connections, and makes subsidy delivery targeted and transparent. The fiscal pressure behind that argument is real: the government has allocated ₹30,000 crore a year for 2025-26 and 2026-27 to compensate the state-owned oil companies for domestic LPG under-recoveries, and accumulated losses still exceeded ₹62,000 crore as of 31 August 2026.
#Why this is not the same as Aadhaar seeding
A lot of the commentary is treating the 89.9 per cent as reassuring. It isn't the number that matters, because it measures something new.
LPG subsidy has been Aadhaar-linked for a decade under the PAHAL (DBTL) direct benefit transfer scheme, where the consumer's Aadhaar number is seeded against the connection ID and bank account so the subsidy can be credited. As of 1 July 2025, 92.44 per cent of active consumers across a 33.05 crore base had Aadhaar seeded in the OMC databases. Seeding is a database join on a number. Biometric Aadhaar Authentication is a live 1:1 match against UIDAI's Central Identities Data Repository, performed on a device, by a person, at a moment in time — and it fails for reasons seeding never did.
That distinction is the entire risk surface. A worn fingerprint does not stop a subsidy from being credited to a bank account; it does stop a refill from being booked at the subsidised price. The ministry itself signalled the friction in a clarification issued on 17 March 2026, after reports circulated that all consumers would have to re-authenticate: eKYC, it said, is required only for unauthenticated customers, with PMUY beneficiaries the standing exception. That the ministry had to say so at all indicates how much confusion the requirement generates at the distributor counter.
The reason UIDAI's FaceRD app is load-bearing here is precisely that fingerprints fail. Documented exclusion errors fall hardest on elderly people and manual labourers, whose ridge patterns are degraded by age and work — the same demographic that makes up a disproportionate share of Ujjwala households. Face authentication is a genuine mitigation. It is also a second biometric modality being pushed into the welfare stack, on consumer-grade phones, at a moment when no enforceable statutory standard governs how the resulting template is handled.
#What the DPDP Act says about Aadhaar biometric authentication for subsidies — and when
Here is the part most coverage is missing. Even after 13 May 2027, consent is not the legal basis for this processing, and nothing about the LPG mandate will require it to be.
Section 7 of the DPDP Act carves out "certain legitimate uses" where a Data Fiduciary may process personal data without consent. Clause (b) covers the State and its instrumentalities processing personal data for the provision or issue of any subsidy, benefit, service, certificate, licence or permit, where that is provided under law or policy or out of public funds. Rule 5 of the DPDP Rules 2025 operationalises it, and the Second Schedule attaches the only substantive discipline: processing must be lawful, confined to the Section 7(b) uses, limited to such personal data as is necessary for those uses, carried out with reasonable efforts toward completeness, accuracy and consistency, protected by reasonable security safeguards against a personal data breach, retained only as long as necessary, accompanied by information to the data principal about the processing, and backed by a published contact for the officer answering data-protection queries.
Read against the LPG mandate, those standards are not decorative. Two of them bite directly:
Data minimisation. A 1:1 biometric match returns a yes/no. The Second Schedule's "limited to such personal data as is necessary" standard is an argument that the authentication result is what the subsidy determination needs — not a retained biometric record, not an audit trail richer than the entitlement decision requires. Whether OMC apps and distributor devices are built to that standard is not currently a question anyone can compel an answer to.
Notice. The requirement to inform the data principal about the processing, and to publish a contact for queries, is the mechanism by which a consumer standing at their own doorstep would learn what is being captured on a delivery agent's phone and who to complain to. It is also the one thing least likely to survive a two-minute doorstep interaction.
Both commence on 13 May 2027. Rule 5 is explicitly in the eighteen-month tranche. So the mandate that takes effect on 1 October 2026 will run for more than seven months before the standards that would govern it are law, and will have processed the biometrics of most of the outstanding 3 crore households by then. Compliance in that window is a policy choice by the Ministry of Petroleum and the oil marketing companies, not a legal obligation — and there is no regulator to ask.
#The Aadhaar Act's own safeguard does not cover this case
The statutory protection people reach for is the proviso to Section 7 of the Aadhaar Act 2016, which is the provision that permits identity authentication to be made a condition of receiving a subsidy funded from the Consolidated Fund in the first place. That proviso says that where an Aadhaar number has not been assigned to an individual, they must be offered "alternate and viable means of identification" for delivery of the subsidy. A separate carve-out states that a child shall not be denied a subsidy, benefit or service for failure to authenticate, with identity to be verified through other documents and recorded in a separate register.
Notice what the proviso protects against: not having an Aadhaar number. It does not, on its face, cover the far more common Indian scenario — having an Aadhaar number and failing the biometric match. The Supreme Court's 2018 Aadhaar judgment upheld Section 7 while insisting that no one be denied entitlements for authentication failure, and that principle has been the basis of exception-handling in ration distribution ever since. But the LPG mandate's fallback is not an exception-handling route for failed authentication. It is a downgrade: market price, smaller cylinders, subject to local availability.
That matters because of the opt-out's design. To not provide your biometrics, you must make a positive registration on a digital channel declaring that you are unwilling or unable — and then accept a materially worse product at a materially higher price. If consent were the legal basis for this processing, Section 6(1) of the DPDP Act would have something sharp to say: consent must be free, specific, informed, unconditional and unambiguous. A choice between a biometric scan and a 5 kg cylinder at market price is not unconditional in any ordinary reading. But Section 7(b) means consent is not the basis, so that standard never engages. This is the structural consequence of the Act's design that privacy practitioners have been pointing at since 2023, now visible in a single scheme affecting 3 crore households.
#What Indian businesses should take from this
The LPG mandate is a template, and any organisation running Aadhaar authentication through a field force should read it as one.
The liability allocation is already knowable. In this architecture the OMC is the Data Fiduciary. The distributor, and the delivery agent holding the phone, are processing on its behalf — a Data Processor relationship that Section 8(2) of the DPDP Act will require to sit under a valid contract, with the fiduciary remaining answerable for the processor's conduct. Companies that push Aadhaar authentication out to franchisees, dealers, gig delivery staff or last-mile agents do not push the liability out with it. Build the contract chain and the device-level controls now; from May 2027 the absence of them is a finding, not a gap.
Authentication result, not authentication record. If your system retains biometric payloads, raw responses or richer logs than the entitlement decision requires, you are holding data the Second Schedule's necessity standard will not support. Retention schedules are cheaper to design before a system has three crore records in it.
Exception handling is a compliance control, not a customer-service nicety. A documented, auditable fallback path for people whose biometrics fail is what separates a lawful eligibility check from a denial of service. The Aadhaar Act's own text points at registers and alternate documents; the DPDP Act's accuracy and completeness standard points the same way.
Consent-based processing needs different plumbing entirely. Where you are a private-sector fiduciary and Section 7(b) is not available to you, consent is the basis — and from 13 November 2026 the Consent Manager framework becomes operable, with a registration window at the Data Protection Board for entities incorporated in India with a minimum net worth of ₹2 crore. Most businesses do not need to become a Consent Manager; they need consent infrastructure that a Consent Manager can interoperate with. Our /consent-manager integration is built against the DPDP Rules' notice, withdrawal and records requirements, and the /resources section has the notice templates and data-flow mapping worksheets for exactly this mapping exercise.
#What households should do before 1 October
If you are among the 89.9 per cent already authenticated, nothing. There is no re-authentication requirement for authenticated consumers, and the ministry has said so twice.
If you are not, the free routes are the OMC app plus Aadhaar FaceRD from home, the distributor's showroom, or the next delivery. No payment is required for BAA, and any demand for one at a distributor counter is worth reporting — the mandate's biggest practical risk in its first weeks is not surveillance but rent-seeking at the last mile, which is what happened in the early PDS authentication rollouts.
If you cannot authenticate — if the fingerprint fails and the face scan fails — the honest position is that you currently have no statutory recourse that anyone can adjudicate. The DPDP Act's grievance-redressal right and the Board's complaint jurisdiction over it are in the May 2027 tranche, and the Board has no members to exercise them in any case. The available route is the ministry's own channels: the 1800 2333 555 helpline, the distributor, and the OMC's grievance portal. Document the failure. When the Board is constituted, contemporaneous records of authentication denial will be the most valuable evidence anyone has.
#The pattern worth naming
India has built the fastest-moving digital public infrastructure in the world and has scheduled the law that governs it to arrive afterwards. The Data Protection Board was constituted in November 2025 and MeitY invited applications for its chairperson and members in May 2026, under a search panel chaired by the Cabinet Secretary; sixteen months in, the posts remain unfilled. Meanwhile the state keeps shipping. Face authentication went into bank workflows in September. Biometric authentication goes into the cooking gas subsidy on 1 October. Consent Managers arrive on 13 November. The substantive obligations arrive in May 2027, last.
None of the individual mandates is indefensible. Leakage in LPG subsidy is real, the fiscal cost is real, and a 1:1 biometric match is a legitimate eligibility control. The problem is sequencing. Every scheme that reaches 3 crore households before 13 May 2027 sets its own defaults for what gets captured, where it is stored and how long it is kept — and those defaults, once written into 30 crore records and thousands of distributor devices, are what the law will have to be retrofitted onto rather than what it will shape.
If your organisation is building on Aadhaar authentication, the eight months before Phase III is the cheapest window you will ever have to get purpose limitation, retention and exception handling right by design. Start with a data-flow map of every place a biometric response enters your systems, and work backwards to what the entitlement decision actually needs. The /resources library has the templates; the /consent-manager integration handles the consent-based half of the problem. What neither can fix is a system that captured more than it needed in 2026 because nobody was yet empowered to ask why.
Sources: PIB — Biometric Aadhaar Authentication Mandatory for Subsidised Domestic LPG Refills from 1 October 2026 · NewsOnAir — Biometric Aadhaar Authentication Mandatory for Subsidised LPG Refills From October 1 · The Tribune — LPG Aadhaar e-KYC: October 1 deadline · ThePrint — Aadhaar biometric authentication mandatory for subsidised refills from Oct 1 · NewsOnAir — Govt clarifies LPG biometric Aadhaar authentication required only for unauthenticated customers · PIB — PAHAL (DBTL) Scheme Delivers Improved Efficiency, Transparency and Consumer-Centric Reforms · CADP — DPDP Rules 2025 full text · MediaNama — How will the govt process personal data under the DPDP Rules · Aadhaar Act 2016 (as amended) — Section 7 · The Wire — Digital Exclusion: Poor, Elderly Face the Brunt of Aadhaar-Based Authentication Errors · LiveLaw — India's Data Protection Board: Established In Law, Absent In Fact · Storyboard18 — Cabinet Secretary to head search panel for data protection board chairperson