#UIDAI Is Taking Aadhaar Abroad. The DPDP Act Was Written to Stop at India's Border

UIDAI has confirmed it is drafting policy and legal changes to make Aadhaar abroad a working proposition for non-resident Indians and OCI cardholders, with proof-of-concept projects already running. The problem is that India's data protection statute does almost the opposite: the DPDP Act attaches its protections to where the person is standing, and for someone standing in Dubai or Toronto, several of them switch off.

This is not a drafting slip that a rule can patch. Section 3 keys the Act's reach to data principals "within the territory of India," and Section 17(1)(d) goes further and expressly exempts the processing of personal data belonging to people who are not. Moving Aadhaar offshore moves a growing class of Aadhaar holders into the part of the statute that was designed to be empty.

#What UIDAI Said About Taking Aadhaar Abroad — and What It Launched Last Week

Two things happened in quick succession.

First, UIDAI CEO Saurabh Vijay used a fireside chat at the Global Fintech Fest in Mumbai in September to set the direction. As MediaNama reported, Vijay said "for Aadhaar, the focus now is making Aadhaar international. We really want to work on the interoperability part of it," and confirmed that "already some POCs are happening." Outlook Business carried the same remarks, including the sharper one: "Our legal framework is also going (in that direction) to make Aadhaar international. We are working on policies to make it (available) for overseas citizens of India (OCIs)." He also trailed a lighter-weight product, "Aadhaar Lite," for low-volume users, with guidelines "very soon."

Second, on 29 September — the 17th Aadhaar Day — UIDAI held its Aadhaar Samvaad event in Kolkata before more than 600 policymakers and industry attendees and launched five initiatives: face authentication for the Electronic Public Distribution System, built with the Department of Food and Public Distribution; SWIK Portal 2.0 for processing authentication approvals for non-government entities; a Sub-AUA/Sub-KUA LITE framework for low-volume authentication users; a new token management system for UIDAI offices; and a website rebuild now carrying 13 languages with 23 planned.

Biometric Update tied the two threads together on 1 October, and the shape of the programme becomes clear: UIDAI is simultaneously widening the domestic authentication base — including into welfare distribution, where the LPG subsidy's mandatory biometric Aadhaar authentication also took effect on 1 October — and preparing to extend the credential past the country's edge. What has not been published is the part that matters most: how overseas enrolment or authentication would actually work.

#Aadhaar Abroad Breaks the Statute's Own Definition of a Resident

Start with the thing most commentary skips. Aadhaar is not an identity card. It is a residency credential, and that is written into the law.

Section 2(v) of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 defines "resident" as an individual who has resided in India for 182 days or more in the twelve months immediately preceding the application for enrolment. Entitlement to an Aadhaar number under Section 3 runs to residents. The 182-day test is the gate.

The Aadhaar and Other Laws (Amendment) Act, 2019 cut a hole in that gate for one group: an NRI holding a valid Indian passport can enrol on arrival without waiting out 182 days, and UIDAI's own FAQ allows the foreign address in the passport to be used. OCI cardholders got no such exemption. They still need the 182 days. And both groups still have to show up in person for biometric capture.

So Vijay's "our legal framework is also going in that direction" is not a figure of speech. Making Aadhaar available to OCIs without the residency qualification means amending the definition of "resident" in a statute whose entire constitutional defence in Puttaswamy rested on its being a narrowly purposed instrument for delivering subsidies to people living in India. That is a Parliament-sized change, not a UIDAI circular — and it is worth watching whether it arrives as a standalone amendment or buried in a finance bill.

There is a second statutory wall. Section 29(1) of the Aadhaar Act says core biometric information shall not be shared with anyone for any reason, and shall not be used for any purpose other than generating Aadhaar numbers and authentication. The Central Identities Data Repository is classified as critical information infrastructure. An overseas enrolment model requires biometrics to be captured somewhere outside India and moved into the CIDR — through a foreign enrolment agency, a consulate, or a partner. Whatever the architecture, Section 29 and the CIDR's protected status were drafted on the assumption that the capture happens on Indian soil, under Indian contracts, with Indian enforcement behind them.

#Where the DPDP Act Stops: The Territory Test in Section 3(b)

Now the data protection layer, and the reason this is a DPDP story rather than only an Aadhaar story.

Section 3 of the DPDP Act 2023 draws the Act's perimeter twice. Clause (a) covers the processing of digital personal data within India. Clause (b) reaches processing outside India — but only where that processing is "in connection with any activity related to offering of goods or services to Data Principals within the territory of India."

Read that again with an OCI in Abu Dhabi in mind. UIDAI itself, processing in India, remains inside the Act under clause (a) — that part holds. But the foreign relying party is a different matter. A bank in the Gulf, a property registrar, a remittance platform or a KYC vendor abroad that authenticates an Aadhaar holder standing in front of it is processing outside India, in connection with offering services to a data principal who is not within the territory of India. Clause (b) does not reach it. The extraterritorial hook that catches a San Francisco SaaS company signing up Indian users simply does not close around the inverse case.

The practical consequence: the Indian-origin identity data flows out, the protective jurisdiction does not follow it, and the data principal's remedy against the entity that actually handled the biometric is governed by whatever local law applies — which, in several of the Gulf states hosting 9.96 million overseas Indians, is materially thinner than the DPDP Act.

#Section 17(1)(d): The Act Deliberately Un-Protects People Outside India

The gap is not accidental, and this is the part that should concentrate minds.

Section 17(1)(d) exempts processing where "personal data of Data Principals not within the territory of India is processed pursuant to any contract entered into with any person outside the territory of India by any person based in India." Where Section 17(1) applies, it switches off Chapter II (the data fiduciary's obligations), Chapter III (the data principal's rights) and Section 16 (cross-border transfer), keeping only the security-safeguards duty in Section 8(1) and the breach-notification duty in Section 8(5).

That clause was written as an export subsidy for India's outsourcing industry. The policy logic was sound in 2023: an Indian BPO processing a German customer's data under a contract with a German client should not be made to run two parallel privacy regimes. The clause assumed the non-resident data principal was a foreigner whose own law would protect them.

A global Aadhaar inverts that assumption. The non-resident data principal becomes an Indian-origin person holding an Indian government credential — and the Indian processor acting for an overseas bank or fintech under an overseas contract lands squarely in 17(1)(d). The same Indian entity that owes a resident in Pune the full suite of notice, purpose limitation, erasure and grievance redressal owes an OCI in Toronto, on the same credential, only reasonable security safeguards and a breach notice.

Then there is Section 17(2)(a), which lets the Central Government notify an instrumentality of the State as exempt from Chapters II and III and Section 16 in the interests of sovereignty, security of the State, friendly relations with foreign States, public order, or preventing incitement. "Friendly relations with foreign States" is doing unusual work in a provision that will now sit next to a cross-border identity programme. No instrumentality has been notified yet. UIDAI is an obvious candidate for one.

#The Cross-Border Rules That Would Govern Aadhaar Abroad Do Not Commence Until May 2027

Section 16 is the provision that would ordinarily govern this — the negative-list model under which transfers outside India are permitted unless the Central Government restricts a destination, with Rule 14 layering on conditions about making data available to foreign states.

It is not in force. Section 16 and the bulk of the substantive obligations commence on 13 May 2027 under the phased schedule MeitY set when it notified the DPDP Rules on 13 November 2025. No country has been placed on a restricted list, because the mechanism to do so is not yet live.

The proof-of-concepts, meanwhile, are running now. That is the mismatch in one line: the pilots for moving India's biometric identity layer across borders are being built during the eighteen-month window in which India's cross-border transfer rule has no legal effect. Whatever architecture those pilots harden into — which foreign entities hold what, under which contracts, with what retention — will be a fait accompli by the time Section 16 can say anything about it. The familiar version of this problem is contracts being redrafted as though the cross-border rules were already in force; here the risk runs the other way, with infrastructure being built as though they never will be. Our DPDP compliance resources track which provisions are actually live.

#The Consent Manager Layer Is Being Built for People Inside India

One more structural point, because it lands on a date that is now six weeks out.

From 13 November 2026, Rule 4 of the DPDP Rules 2025 activates the consent manager regime: registration with the Data Protection Board of India, a minimum net worth of ₹2 crore, and — critically — incorporation in India. Consent managers are meant to be the interoperable dashboard through which a data principal grants, reviews and withdraws consent across every fiduciary they deal with.

That layer is being built around Indian incorporation, Indian grievance redressal and an Indian regulator. Nothing in Rule 4 contemplates a registered consent manager mediating an authentication performed by a foreign relying party for a data principal sitting abroad. If Aadhaar abroad arrives before that question is answered, overseas Aadhaar holders get the credential without the control surface that is supposed to come with it. Organisations working through what the November deadline actually requires of them can start with our consent manager guidance.

#What AUAs, Banks and Fintechs Should Be Doing Now

The 37.3 million overseas Indians recorded by the Ministry of External Affairs as of January 2026 — 17.8 million NRIs and 19.5 million PIOs — are a large and commercially attractive onboarding pool, and the institutions that serve them should not wait for the legal framework to settle before mapping their exposure.

Three concrete steps:

Map which of your flows involve a data principal outside India. NRI account onboarding, remittance KYC, overseas property transactions, pension and insurance servicing for retirees abroad. For each, establish whether the contract sits with an entity outside India — because that single fact is what pulls the flow into Section 17(1)(d) and out of the Act's substantive obligations.

Do not treat the exemption as a compliance saving. An exemption from Chapter II is not an exemption from reputational, contractual or foreign-law liability, and it does not survive a change in the data principal's location. Someone who onboards as an NRI and returns to India becomes a fully protected data principal mid-relationship, with retrospective rights over data you collected under a lighter regime. Build to the higher standard and the question never arises.

Separate your Aadhaar authentication design from your Aadhaar-abroad roadmap. Nothing about overseas authentication has been published. Any vendor currently selling an "international Aadhaar eKYC" capability is selling an assumption, and AUA/KUA licence conditions do not currently contemplate offshore relying parties.

#The Gap Is Jurisdictional, Not Technical

UIDAI's international ambition is coherent on its own terms: 37 million people with Indian financial, property and family ties cannot currently use the credential that unlocks all three. Interoperability is a real problem worth solving.

But the DPDP Act's protections are not portable. They are keyed to presence inside the territory, and in Section 17(1)(d) the statute deliberately withdraws them from people outside it. Extending Aadhaar abroad without amending that provision would create a class of Aadhaar holders who carry an Indian government biometric credential and, in the hands of a foreign relying party or an Indian processor working under a foreign contract, almost none of the Indian rights that are supposed to accompany it.

That is a question for Parliament and for MeitY, and it is better answered before the proof-of-concepts become production than after. If your organisation touches NRI or OCI data, the useful move this quarter is to stop treating "outside India" as an exemption to be enjoyed and start treating it as a liability to be mapped. Our compliance resources are the place to begin.