#UIDAI Just Pushed Aadhaar Face Authentication Onto Bank Servers. The DPDP Act Says That Liability Is Now Theirs.

On 9 September 2026, at the Global Fintech Fest in Mumbai, UIDAI launched a software development kit that lets banks and other partner institutions run Aadhaar face authentication on their own servers instead of routing every request through UIDAI's central systems. That single architectural change moves the most attack-prone part of India's identity infrastructure out of a hardened government perimeter and into several hundred private ones — and under the Digital Personal Data Protection Act 2023, it moves the legal liability for a breach along with it.

UIDAI's part-time Chairperson Neelkanth Mishra was explicit about the trade. Under the new model, he said, banks "would be responsible for securing their local authentication process," and "any exposure arising from that process would not extend to UIDAI's central systems." That is a candid description of risk transfer. The question nobody at the Fest answered is who, in September 2026, is positioned to hold the receiving end of that transfer to account.

#What UIDAI Actually Announced About Aadhaar Face Authentication

The announcement had two parts, both made on 9 September at the seventh Global Fintech Fest, held 8–11 September at Mumbai's Jio World Centre.

The first is the Aadhaar Face Authentication SDK — a ready-to-integrate kit that brings face authentication directly into native Android and iOS applications, so users no longer have to switch between apps to verify themselves. It ships with AI/ML-based liveness detection and anti-spoofing, and handles encryption of authentication data. It is designed to work on ordinary consumer smartphones rather than dedicated biometric hardware.

The second is a testing sandbox, where organisations can validate the complete authentication journey — user provisioning and consent, face capture, liveness checks, authentication, error handling and response validation — before going live, again without external biometric devices.

The scale explains the urgency. Authentication volumes have climbed from roughly 7 crore transactions a day a few years ago to about 10 crore today, and UIDAI is building toward 25–30 crore. More than 600 entities use Aadhaar authentication, and the Aadhaar app is approaching 6 crore downloads. A ten-year roadmap covers post-quantum cryptography, AI-based fraud detection — "we are also using AI extensively for fraud detection," Mishra said — and Aadhaar authentication for Indians outside India.

That last item is the real driver behind the decentralised design. Aadhaar authentication has long been geofenced to Indian territory, locking out non-resident Indians and Indians travelling abroad. Removing the fence centrally would widen the attack surface on a system Mishra called "critical infrastructure" facing hundreds of attacks every day. His framing was blunt: "The problem with removing geofencing is, then you are vulnerable." Pushing verification to a partner's own server sidesteps that by never exposing UIDAI's core to the foreign request at all.

One caveat the trade press has skipped: UIDAI has not published full technical specifications for the local-processing model. Some coverage describes an SDK embedded in a partner's mobile app; other coverage describes authentication executing on a bank's own servers. Those are different architectures with different risk profiles, and at least one outlet noted that the announcement did not specify where processing occurs. The legal analysis below holds either way; the security analysis cannot be completed until UIDAI publishes the spec.

#Why Aadhaar Face Authentication Can Move Off UIDAI's Servers When Fingerprints Cannot

This is not a policy choice UIDAI made freely. Face is the only biometric it could legally have chosen, for reasons sitting in two definitions in the Aadhaar Act, 2016.

Section 2(g) defines "biometric information" to include photograph, fingerprint and iris scan. Section 2(j) defines "core biometric information" as fingerprint, iris scan, and such other biological attributes as may be specified by regulations — and conspicuously excludes the photograph.

That exclusion carries enormous weight, because Section 29(1) provides that no core biometric information shall be shared with anyone "for any reason whatsoever," or used for any purpose other than generating Aadhaar numbers and performing authentication. It is one of the most absolute prohibitions in Indian data law. Section 29(2) then treats identity information other than core biometric information far more permissively: it may be shared in accordance with the Act and as specified by regulations.

So a decentralised fingerprint or iris model would have been flatly unlawful. A decentralised face model is not, because the drafters in 2016 classified the photograph as biometric information but not core biometric information — a distinction made when "photograph" meant a picture on a card, years before liveness-checked facial recognition on a consumer phone became the default onboarding method for Indian finance. India's newest identity architecture is being built through a gap left by a nine-year-old definition.

Existing UIDAI obligations do not lapse either way. Any entity storing Aadhaar numbers must keep them in an Aadhaar Data Vault, tokenised behind reference keys and encrypted, with keys in hardware security modules and access strictly logged. Those duties attach to Authentication User Agencies and KYC User Agencies regardless of where matching now happens.

#The DPDP Act Treats Your Face Like Your Email Address

Here is where India diverges sharply from the regime it is most often compared to.

Under the GDPR, biometric data processed to uniquely identify a person is a special category under Article 9. Processing is prohibited by default and permitted only through narrow gateways, on top of an ordinary Article 6 lawful basis. A European bank deploying face authentication starts from a presumption against.

The DPDP Act 2023 has no equivalent tier. It recognises "personal data" and nothing above it: no special category, no sensitive personal data class, no heightened threshold for biometrics. A facial template that can identify a person for life sits in the same statutory box as their email address. The Act also recognises only two grounds for processing — consent and certain "legitimate uses" — against the GDPR's six, with no legitimate-interests basis to fall back on.

That matters now, because face authentication is being pushed out to hundreds of institutions of wildly varying security maturity and Indian law gives a bank no statutory signal that the data class it just took on is more dangerous than any other. The signal must come from the bank's own risk function, from a sectoral regulator, or from nowhere.

#Who Carries the Liability Now

Every bank in India — scheduled commercial, cooperative, regional rural, and foreign branches — is a Data Fiduciary under the DPDP Act, because it determines the purpose and means of processing personal data. Running face authentication locally does not change that status; it enlarges what the status covers.

Section 8(5) requires a Data Fiduciary to take reasonable security safeguards to prevent a personal data breach. Rule 6 of the DPDP Rules 2025 puts specifics behind the phrase: encryption, obfuscation or masking; access control limited to authorised personnel; logging and monitoring of access and processing, with logs retained for one year; documented incident response; and contractual flow-down requiring processors to maintain equivalent safeguards.

Two features deserve emphasis for anyone deploying this SDK.

First, the duty follows the data outward. A Data Fiduciary's security obligation extends to lapses at a third party to whom it transmitted the data, so vendor diligence and contractual allocation of breach responsibility are not optional paperwork. A bank that licenses an integration partner to stand up its face-authentication stack has not outsourced its exposure.

Second, the penalty is the largest in the Act. The Schedule sets a ceiling of ₹250 crore specifically for failure to take reasonable security safeguards to prevent a personal data breach — higher than the ceilings for children's data or breach-notification failures. Of every category of non-compliance the legislature contemplated, this is the one it priced highest, and it is precisely the category this architectural shift multiplies.

Timing deserves honesty, which the vendor content circulating this week mostly lacks. The penalty provisions are not in force today. The DPDP Rules were notified on 13 November 2025 via G.S.R. 846(E); Rules 3 and 5 to 16, the substantive duties and the Schedule's penalties all commence on 13 May 2027. The exposure above is real and dated, but prospective. What a bank builds in September 2026 is what it will be audited against in May 2027 — the actual reason to get the architecture right now.

#Three Regulators, Three Clocks, and One That Does Not Exist

Suppose a bank's local face-authentication stack is compromised in 2027. Trace the notifications.

CERT-In starts first. Under the Directions of 28 April 2022, issued under Section 70B of the IT Act and in force since 27 June 2022, certain cyber incidents must be reported within six hours of being noticed. The same Directions require 180 days of log retention and carry penalties of up to ₹1 lakh and a year's imprisonment.

The RBI runs a second clock, and it got considerably heavier this year. On 31 July 2026 the Reserve Bank issued seven Directions under a single title — the Cybersecurity, Technology: Risk, Resilience and Assurance Framework — one each for commercial banks, small finance banks, payments banks, urban cooperative banks, all-India financial institutions, NBFCs and credit information companies. They took effect immediately, retire both the 2016 Cyber Security Framework and the 2023 Master Direction on IT Governance, and mandate vulnerability assessments every six months, annual penetration tests for critical internet-facing systems and half-yearly disaster recovery drills. Most consequentially here, they make cybersecurity an explicit, non-delegable board-level responsibility. A board that signs off on decentralised biometric authentication now owns that decision personally.

The DPDP Board runs the third clock. Rule 7 requires a Data Fiduciary to inform each affected Data Principal without delay, notify the Board without delay with initial particulars, and file a detailed report within 72 hours. There is no materiality threshold: a breach touching ten records carries the same obligation as one touching ten million. The clock starts at organisational awareness, not at intrusion.

Except that the third recipient does not exist. The Data Protection Board of India was established in law on 13 November 2025. Ten months later it has no Chairperson and no Members. MeitY invited applications on 6 May 2026 and followed up on 6 June 2026, with a search-cum-selection committee chaired by the Cabinet Secretary. No shortlist, no appointment order, no gazette notification.

A caution for anyone researching this independently: search engines and AI summarisers now confidently return fabricated names for the Board's Chairperson, including from a Wikipedia infobox. There is no appointment. Verify any claim otherwise against a MeitY appointment order or a Gazette of India notification, and nothing less.

So the notification architecture meant to govern a national biometric rollout has three thresholds, three recipients, no coordination between them, and one recipient that cannot receive anything. The consent-manager registration framework under Rule 4 switches on 13 November 2026 — nine weeks away — and runs through that same absent Board.

#What Businesses Should Do Before May 2027

For any institution weighing this SDK, the work is unusually concrete.

Decide where matching happens, and write it down. Since UIDAI has not published the architecture, establish contractually and technically whether face templates or capture data ever rest on your infrastructure, for how long, and in what form. Your Rule 6 obligations and your breach-notification exposure both hinge on that answer.

Treat face data as sensitive even though the Act does not. Apply the tier the statute omits: separate key management, tighter access control, shorter retention, dedicated logging. Regulators assessing "reasonable" safeguards in 2027 will read reasonableness against the sensitivity of the data, not against the flatness of the statute.

Map the three clocks before you need them. A single incident triggers CERT-In at six hours, your RBI Direction on its own terms, and DPDP Rule 7 at 72 hours. Build one runbook satisfying the tightest constraint, and pre-draft the Board notification even though there is nobody to send it to yet. Rule 7 will not wait for the Board to be staffed.

Fix your contracts. Survey evidence suggests more than 80% of Indian organisations have not updated or drafted DPDP-aligned contracts. If an integration partner touches your face-authentication stack, the Rule 6 processor flow-down is the gap to close first.

Do not confuse Data Fiduciary with Consent Manager. If you collect consent from your own users for your own processing, you are a Data Fiduciary and Rule 4 registration does not apply to you. It applies only to cross-platform consent intermediaries, which must be incorporated in India, hold ₹2 crore minimum net worth, owe a fiduciary duty to the Data Principal, and remain data-blind — unable to read the personal data they route. Our consent manager explainer covers the First Schedule in full.

#What This Means for Citizens

The convenience is real. Face authentication on an ordinary phone, without a fingerprint scanner and with the geofence lifted, genuinely helps the NRI locked out of their own bank and anyone whose fingerprints no longer read reliably — a well-documented exclusion problem for manual labourers and the elderly.

The asymmetry is also real. When authentication ran only through UIDAI, there was one perimeter to defend and one body accountable for it. There are now potentially hundreds, with security maturity ranging from tier-one private banks to small NBFCs, and UIDAI's Chairperson has said on the record that exposure arising in those perimeters is not UIDAI's.

Should a Data Principal's facial biometric be compromised, the DPDP Act offers something less than a remedy. Penalties imposed by the Board go into the Consolidated Fund of India; they do not compensate the person breached. For a stolen password that is defensible design. For a facial template it is not, because the individual cannot rotate their face. They carry the compromise for life while the penalty funds the exchequer.

#The Bottom Line

UIDAI has made a defensible engineering decision under a real constraint. Central geofence removal genuinely would have widened the attack surface on critical infrastructure, and the photograph's exclusion from "core biometric information" in 2016 gave UIDAI the one lawful path to decentralisation available to it.

But the decision distributes biometric risk across hundreds of private balance sheets at the exact moment India's enforcement machinery is at its weakest — penalties eight months from commencement, a consent-manager deadline nine weeks out, and a Data Protection Board that has been a legal fiction for ten months. Risk transfer works when the receiving party is supervised. Right now the supervision is scheduled, not staffed.

Institutions integrating this SDK should build to the 13 May 2027 standard from the first commit, not the September 2026 one. The current enforcement vacuum will be no defence when the Board finally sits — and the first thing a functioning regulator examines is the decisions made while it was not watching.

Assessing your Aadhaar authentication stack against DPDP obligations? Our resources library tracks commencement dates, Rule 6 safeguards and breach-notification timelines as they take effect.

#Sources

• UIDAI launches new face authentication software development kit to ease Aadhaar access for Indians overseas — Business Today, 9 September 2026
• UIDAI Launches New Aadhaar Face Authentication SDK, Banks Can Run Verification On Their Own Servers — Free Press Journal, 9 September 2026
• UIDAI Launches SDK, Sandbox To Ease Aadhaar Face Authentication — Inc42, 9 September 2026
• Section 29, Aadhaar Act 2016 — Restriction on sharing information
• Rule 7, DPDP Rules 2025 — Intimation of personal data breach
• Article 9 GDPR — Processing of special categories of personal data
• India's Data Protection Board: Established In Law, Absent In Fact — LiveLaw
• Brief on RBI Cybersecurity, Technology, Risk, Resilience and Assurance Framework Directions, 2026 — DSCI