India Stack

India Stack

Coined by	iSPIRT (c. 2012-2013)
Components	Aadhaar, UPI, DigiLocker, ABDM, ONDC
Governing bodies	UIDAI, NPCI, NHA, MeitY
Country	India
Websites	indiastack.org

India Stack is a collection of government-operated digital public infrastructure systems in India. The term encompasses identity verification (Aadhaar), payments (UPI), document storage (DigiLocker), and data sharing layers–each governed by separate government bodies with distinct legal frameworks.

The systems within the India Stack have achieved significant scale, with UPI processing over 10 billion monthly transactions and Aadhaar covering 1.4 billion residents. India Stack has been credited with supporting India's digital economy, financial inclusion, and e-government initiatives.¹² It has also faced criticism regarding welfare exclusion linked to biometric authentication failures, and concerns around privacy, consent, and digital divide.³

The term "India Stack" was coined by iSPIRT, a technology industry think tank co-founded by Sharad Sharma in 2013. iSPIRT positioned the branding to describe separate government systems as a unified, exportable model of digital public infrastructure (DPI).⁴ Despite the branding, each component (Aadhaar under UIDAI, UPI under NPCI, DigiLocker under MeitY, ABDM under NHA) is closed-source and separately governed.

India Stack comprises several separately governed layers:

• Identity Layer (Aadhaar): Biometric identification system covering 1.4 billion residents, governed by Unique Identification Authority of India (UIDAI)
• Payments Layer (UPI, BBPS, AePS): Digital payment infrastructure governed by National Payments Corporation of India (NPCI), a private Section 8 company
• Data Layer (DigiLocker, Account Aggregator): Document storage governed by MeitY; financial data sharing governed by Sahamati (industry alliance)
• Health Layer (ABDM): Health records infrastructure governed by National Health Authority (NHA)
• Commerce Layer (ONDC): E-commerce protocol governed by ONDC Ltd, a Section 8 company

India Stack components have achieved significant transaction volumes:

• UPI: Over 10 billion monthly transactions by 2023⁵
• Aadhaar: 1.4 billion enrolments
• DigiLocker: Over 150 million registered users

Proponents credit India Stack with expanding financial inclusion through Jan Dhan bank accounts, reducing subsidy leakage through Direct Benefit Transfer, and enabling digital service delivery.

Aadhaar-based biometric authentication for welfare distribution has been linked to documented exclusions and deaths. Research by economists including Reetika Khera of IIT Delhi has found significant exclusion of genuine beneficiaries.

Key findings include:

• Between 2013-2021, 4.39 crore (43.9 million) ration cards were deleted nationally
• A 2020 J-PAL study found 88% of cancelled ration cards in Jharkhand belonged to genuine beneficiaries, not fraudulent "ghost" entries⁶
• The Right to Food Campaign documented 57 starvation deaths in nine Indian states from 2015 onwards, with at least 19 directly linked to Aadhaar-related denial⁷
• Of 42 hunger-related deaths documented between 2017-2019, 25 were linked to Aadhaar issues.⁸ Documented cases include Santoshi Kumari (11, Jharkhand, 2017), Arjun Hembram (11, Odisha, 2023), and others.
• Human Rights Watch documented 2.5 million families in Rajasthan denied ration supplies between September 2016 and June 2017 due to Aadhaar issues. The report also found children without Aadhaar excluded from government schools and hospitals demanding Aadhaar enrolment before issuing birth certificates.³
• In June 2024, the government directed 100% e-KYC compliance for all ration card holders. Odisha suspended rice distribution for 20+ lakh (2 million+) eligible individuals for e-KYC non-compliance.⁹

A 2011 Centre for Internet and Society analysis estimated that "two to five per cent of the Indian population would be excluded" due to biometric failures alone. The analysis highlighted that fingerprints may degrade due to manual labour, and certain medical conditions may not produce valid fingerprint and iris scans.¹⁰

In 2022, the failure rate was 8.5% for authentication using iris and 6% using fingerprints at the national level. A CAG report found that UIDAI took no responsibility for deficient biometric capture at the time of enrolment.¹¹ In 2023, UIDAI acknowledged 54 hours of service downtime due to OTP delays and server issues.¹²

Rajasthan mandated facial authentication for pensioners via the RAJSSP app in February 2023. The system was reportedly tested on only 15-20 people before statewide rollout. Data from January-April 2025 showed a facial authentication success rate of 69.11% and a fingerprint authentication success rate of 76.27%. Officials attributed the failure rates to the fact that some individuals had to make multiple attempts.¹³

UIDAI claims Aadhar authentication requires "explicit consent", but critics argue that consent is structurally compromised when Aadhaar authentication is mandatory for several essential services. Researchers note refusal of consent would result in exclusion from food rations under Public Distribution System, pension disbursement, bank account access due to KYC requirements, LPG subsidies, government employment wages under MGNREGA, healthcare access (ABDM), and FASTag vehicle toll payment system which is mandated by law.⁹

Critics have also raised concerns that Aadhaar deactivations can occur without prior notice, which could deprive people of their basic needs.¹⁴

Although the Supreme Court of India ruled privacy a fundamental right in August 2017,¹⁵ the centralised nature of India Stack creates surveillance infrastructure concerns:

• Centralised biometric database of 1.4 billion people
• Authentication logs enabling tracking of citizens' access to services
• Cross-linking of identity, financial, health, and location data
• Limited independent oversight and RTI exemptions

In September 2018, the court upheld Aadhaar's constitutional validity but struck down Section 57 allowing private sector use. The government subsequently amended laws through ordinances to restore private sector access.¹⁶

A Financial Times report in 2023 questioned claims of "open APIs" of the India Stack. It noted that the India Stack does not follow free and open-source software principles as its source code is not publicly available, no public contribution or proposal mechanism exists, and it cannot be forked or independently operated. It also highlighted that governance is not participatory and alternative implementations are legally prohibited.⁴

The COVID-19 vaccination rollout via CoWIN highlighted digital divide issues, as offline registration option was unavailable initially.¹⁷ CoWIN required smartphone, internet access, and digital literacy, but 25% of India's population had no smartphone and over 200 million Indians had no or poor internet access.

In May 2021, the Supreme Court noted that CoWIN was not accessible to persons with disabilities.¹⁸

Several countries have expressed interest in adopting India Stack components. Sri Lanka, Morocco, the Philippines, Guinea, Ethiopia, and Togo have reportedly started using components.¹⁹