Open the KYC archive of a typical Indian fintech, and you will find thousands of Aadhaar images with all twelve digits visible. Each one is a compliance liability. Aadhaar masking– redacting the first eight digits so only the last four remain visible is not a best practice. It is a legal requirement, and CKYC 2.0 has now made automated masking a hard gate for every record submitted to the central registry.
The gap between the rule and reality is wide. Many institutions mask new captures but ignore legacy archives. Others mask the image but store the full number in a database column. This guide explains what Aadhaar masking actually requires, where the obligations come from, how to automate it, and how to remediate the records you already hold.
What Is Aadhaar Masking?
Aadhaar masking is the redaction of the first eight digits of a twelve-digit Aadhaar number, on documents and in data stores, so that only the last four digits remain readable. A masked Aadhaar still functions as identity evidence. UIDAI itself issues masked Aadhaar downloads, and DigiLocker serves Aadhaar as a masked PDF.
The logic is data minimisation. The full Aadhaar number is a persistent identifier that can link an individual across databases. The last four digits, combined with name and photograph, are enough for most verification purposes without creating that linkage risk.
Masking applies to more than the number printed on the card image. It covers scanned copies, photocopies, PDFs, OCR-extracted data fields, QR-code payloads stored in raw form, and any log file where the number might appear. A masked image sitting next to an unmasked database column is not compliance; it is decoration.
The Legal Basis: Aadhaar Act, UIDAI Regulations, and Supreme Court Guardrails
Three layers of law drive Aadhaar masking obligations.
First, the Aadhaar Act, 2016 and its amendments restrict how entities collect, use, and store Aadhaar numbers. The 2019 amendments introduced civil penalties up to â‚ą1 crore per contravention for entities in the Aadhaar ecosystem that violate UIDAI directions, with further penalties for continuing failures.
Second, UIDAI’s regulations and circulars require requesting entities to avoid storing full Aadhaar numbers except under tightly defined conditions, and to use masking wherever full numbers are not strictly necessary. UIDAI has repeatedly directed entities to purge or mask improperly stored Aadhaar data.
Third, the Supreme Court’s Puttaswamy judgment (2018) narrowed permissible Aadhaar use and pushed the ecosystem toward privacy-preserving alternatives: offline XML, QR verification, and masked artefacts. Regulatory frameworks built since, including the RBI’s KYC Master Directions and now CKYC 2.0, assume masked Aadhaar as the default handling standard.
The DPDP Act adds a general-purpose layer on top. As a data fiduciary, an institution holding unmasked Aadhaar images is holding high-risk personal data it usually has no legal basis to retain in that form- an exposure we mapped in our post on [data fiduciary duties under the DPDP Act]
Where Aadhaar Masking Is Mandatory in Practice
Four operational surfaces demand masking today.
CKYC uploads. CKYC 2.0 rejects submissions carrying unmasked Aadhaar, and the masking must be automated rather than manual. Institutions with manual redaction steps in their pipeline will see rejection rates climb.
KYC document storage. Copies of Aadhaar collected during onboarding, physical or digital, must be masked before storage. This includes documents captured through video KYC sessions and OCR pipelines, where extracted fields must store masked values.
Customer-facing displays. Account statements, service screens, and communications should never echo a full Aadhaar number back to the user or to staff who do not need it.
Internal analytics and logs. Aadhaar numbers leak into application logs, support tickets, and data warehouses with surprising ease. The masking policy must extend to these secondary stores, because auditors and attackers both look there first.
How Automated Aadhaar Masking Works
Manual redaction does not scale and does not satisfy CKYC 2.0. Automated Aadhaar masking pipelines combine three techniques.
A document-understanding model locates Aadhaar numbers on an image or PDF, regardless of layout, orientation, or quality. This is harder than it sounds: numbers appear on cards, e-Aadhaar letters, photocopies of photocopies, and cropped screenshots. High-recall detection matters more than elegance, because a missed number is a compliance failure.
The pipeline overlays an irreversible mask on the first eight digits in the image layer, not just an annotation layer that a PDF reader can toggle off. For text and data fields, the stored value becomes XXXX-XXXX-1234 or the last four digits alone.
A second pass confirms no readable Aadhaar digits survive outside the permitted four. Mature pipelines log a masking certificate per document: what was detected, what was redacted, and when. This becomes audit evidence.
Latency targets are practical: masking should run in-line during onboarding, in well under a second per document, so that the masked artefact is the only version that ever reaches storage. Masking after storage means an unmasked copy existed, and backups remember.
The Aadhaar Data Vault: Masking’s Companion Requirement
Masking answers what you display and store in documents. The Aadhaar Data Vault answers where a full number may live when a legitimate need exists.
UIDAI requires entities that must retain Aadhaar numbers to keep them only in a secured, access-controlled Aadhaar Data Vault, encrypted with HSM-managed keys. Application databases hold a reference token instead of the number. Systems that need the real number for an authorised purpose exchange the token through controlled access.
The combination is the compliant architecture: masked artefacts everywhere by default, tokenised references in application systems, and full numbers confined to the vault under audit. If your architecture has full Aadhaar numbers in an ordinary customer table, no amount of image masking fixes it.
Remediating Legacy Records
Most institutions’ real Aadhaar masking problem is historical. Years of onboarding produced archives of unmasked images and columns. A defensible remediation programme has four steps.
Inventory. Crawl document stores, databases, data lakes, and log archives for Aadhaar patterns. Expect to find them in places no policy anticipated.
Prioritise. Rank stores by exposure: internet-facing systems and broadly accessible shares first, cold archives later.
Mask and tokenise in place. Run the automated pipeline across the inventory, replacing artefacts with masked versions and migrating any retained numbers into the vault. Destroy superseded unmasked copies, including in backup rotation as cycles allow.
Prove it. Keep remediation logs. Regulators respond very differently to “we found a gap and closed it with evidence” than to a gap they discover themselves. This exercise pairs naturally with the broader [KYC remediation programme] many institutions are already running.
Key Takeaways
- Aadhaar masking showing only the last four digits is a legal requirement rooted in the Aadhaar Act, UIDAI directions, and the Puttaswamy judgment, not an optional hygiene measure.
- CKYC 2.0 makes automated Aadhaar masking a hard gate: unmasked submissions face real-time rejection.
- Masking must cover images, extracted data fields, logs, and analytics stores not just the document a customer sees.
- Where full numbers must be retained, they belong in an encrypted Aadhaar Data Vault with tokenised references, never in ordinary application tables.
- Legacy archives are the biggest exposure; run an inventory-prioritise-mask-prove remediation programme and keep the evidence.
Frequently Asked Questions
Q1. What is Aadhaar masking and why is it required?
Aadhaar masking redacts the first eight digits of the Aadhaar number so only the last four remain visible. It is required under UIDAI’s data-handling directions and the Aadhaar Act framework to minimise the risk of the full number being misused as a linking identifier.
Q2. Is Aadhaar masking mandatory for CKYC uploads?
Yes. Under CKYC 2.0, every record submitted to the central registry must carry automated Aadhaar masking. Submissions with visible full Aadhaar numbers are rejected at validation, so institutions need masking built into the pipeline, not applied manually afterwards.
Q3. Does Aadhaar masking apply to data fields or only to document images?
Both. Aadhaar masking obligations cover scanned images, PDFs, OCR-extracted database fields, logs, and analytics stores. A masked image alongside an unmasked database column still violates the data-minimisation requirement.
Q4. Can a business ever store the full Aadhaar number despite Aadhaar masking rules?
Only when there is an authorised need, and then only inside an Aadhaar Data Vault an encrypted, access-controlled store mandated by UIDAI. Application systems hold reference tokens, while masked versions are used everywhere else.
Q5. What is the penalty for ignoring Aadhaar masking requirements?
The Aadhaar Act’s 2019 amendments allow civil penalties of up to ₹1 crore per contravention for entities violating UIDAI directions, with additional daily penalties for continuing failures. Unmasked archives also create exposure under the DPDP Act and RBI KYC norms.
Conclusion
Aadhaar masking looks like a small image-processing task and is actually an architecture decision. Institutions that treat it as redaction keep rediscovering unmasked copies in logs, backups, and data lakes. Institutions that treat it as data minimisation masked by default, tokenised where needed, vaulted where retained close the issue once.
The regulatory direction is one-way. CKYC 2.0 enforces masking at the point of submission, the DPDP Act penalises needless retention, and every new UIDAI circular narrows the space for full-number handling. The cheapest time to build automated masking was during onboarding-flow design; the second cheapest time is now.
