{"id":1156,"date":"2026-07-20T06:43:27","date_gmt":"2026-07-20T05:43:27","guid":{"rendered":"https:\/\/www.befisc.com\/fintechsherlock\/?p=1156"},"modified":"2026-07-20T06:43:28","modified_gmt":"2026-07-20T05:43:28","slug":"aadhaar-masking-rules-india","status":"publish","type":"post","link":"https:\/\/www.befisc.com\/fintechsherlock\/aadhaar-masking-rules-india\/","title":{"rendered":"Aadhaar Masking: The UIDAI Rule Most Fintechs Still Get Wrong"},"content":{"rendered":"\n

Open the KYC archive of a typical Indian fintech, and you will find thousands of Aadhaar images with all twelve digits visible. Each one is a compliance liability. Aadhaar masking<\/a>– redacting the first eight digits so only the last four remain visible is not a best practice. It is a legal requirement, and CKYC 2.0 has now made automated masking a hard gate for every record submitted to the central registry.<\/p>\n\n\n\n

The gap between the rule and reality is wide. Many institutions mask new captures but ignore legacy archives. Others mask the image but store the full number in a database column. This guide explains what Aadhaar masking actually requires, where the obligations come from, how to automate it, and how to remediate the records you already hold.<\/p>\n\n\n\n

What Is Aadhaar Masking?<\/strong><\/h2>\n\n\n\n

Aadhaar masking is the redaction of the first eight digits of a twelve-digit Aadhaar number, on documents and in data stores, so that only the last four digits remain readable. A masked Aadhaar still functions as identity evidence. UIDAI itself issues masked Aadhaar downloads, and DigiLocker serves Aadhaar as a masked PDF.<\/p>\n\n\n\n

The logic is data minimisation. The full Aadhaar number is a persistent identifier that can link an individual across databases. The last four digits, combined with name and photograph, are enough for most verification purposes without creating that linkage risk.<\/p>\n\n\n\n

Masking applies to more than the number printed on the card image. It covers scanned copies, photocopies, PDFs, OCR-extracted data field<\/a>s, QR-code payloads stored in raw form, and any log file where the number might appear. A masked image sitting next to an unmasked database column is not compliance; it is decoration.<\/p>\n\n\n\n

The Legal Basis: Aadhaar Act, UIDAI Regulations, and Supreme Court Guardrails<\/strong><\/h2>\n\n\n\n

Three layers of law drive Aadhaar masking obligations.<\/p>\n\n\n\n

First, the Aadhaar Act, 2016 and its amendments restrict how entities collect, use, and store Aadhaar numbers. The 2019 amendments introduced civil penalties up to \u20b91 crore per contravention for entities in the Aadhaar ecosystem that violate UIDAI directions, with further penalties for continuing failures.<\/p>\n\n\n\n

Second, UIDAI\u2019s regulations and circulars require requesting entities to avoid storing full Aadhaar numbers except under tightly defined conditions, and to use masking wherever full numbers are not strictly necessary. UIDAI has repeatedly directed entities to purge or mask improperly stored Aadhaar data.<\/p>\n\n\n\n

Third, the Supreme Court\u2019s Puttaswamy judgment (2018) narrowed permissible Aadhaar use and pushed the ecosystem toward privacy-preserving alternatives: offline XML, QR verification, and masked artefacts. Regulatory frameworks built since, including the RBI\u2019s KYC Master Directions <\/a>and now CKYC 2.0, assume masked Aadhaar as the default handling standard.<\/p>\n\n\n\n

The DPDP Act adds a general-purpose layer on top. As a data fiduciary, an institution holding unmasked Aadhaar images is holding high-risk personal data it usually has no legal basis to retain in that form- an exposure we mapped in our post on [data fiduciary duties under the DPDP Act<\/a>] <\/p>\n\n\n\n

Where Aadhaar Masking Is Mandatory in Practice<\/strong><\/h2>\n\n\n\n

Four operational surfaces demand masking today.<\/p>\n\n\n\n

CKYC uploads. CKYC 2.0 rejects submissions carrying unmasked Aadhaar, and the masking must be automated rather than manual. Institutions with manual redaction steps in their pipeline will see rejection rates climb. <\/p>\n\n\n\n

KYC document<\/a> storage. Copies of Aadhaar collected during onboarding, physical or digital, must be masked before storage. This includes documents captured through video KYC sessions and OCR pipelines, where extracted fields must store masked values.<\/p>\n\n\n\n

Customer-facing displays. Account statements, service screens, and communications should never echo a full Aadhaar number back to the user or to staff who do not need it.<\/p>\n\n\n\n

Internal analytics and logs. Aadhaar numbers leak into application logs, support tickets, and data warehouses with surprising ease. The masking policy must extend to these secondary stores, because auditors and attackers both look there first.<\/p>\n\n\n\n

How Automated Aadhaar Masking Works<\/strong><\/h2>\n\n\n\n

Manual redaction does not scale and does not satisfy CKYC 2.0. Automated Aadhaar masking pipelines combine three techniques.<\/p>\n\n\n\n

A document-understanding model locates Aadhaar numbers on an image or PDF, regardless of layout, orientation, or quality. This is harder than it sounds: numbers appear on cards, e-Aadhaar letters, photocopies of photocopies, and cropped screenshots. High-recall detection matters more than elegance, because a missed number is a compliance failure.<\/p>\n\n\n\n

The pipeline overlays an irreversible mask on the first eight digits in the image layer, not just an annotation layer that a PDF reader can toggle off. For text and data fields, the stored value becomes XXXX-XXXX-1234 or the last four digits alone.<\/p>\n\n\n\n

A second pass confirms no readable Aadhaar digits survive outside the permitted four. Mature pipelines log a masking certificate per document: what was detected, what was redacted, and when. This becomes audit evidence.<\/p>\n\n\n\n

Latency targets are practical: masking should run in-line during onboarding, in well under a second per document, so that the masked artefact is the only version that ever reaches storage. Masking after storage means an unmasked copy existed, and backups remember.<\/p>\n\n\n\n

The Aadhaar Data Vault: Masking\u2019s Companion Requirement<\/strong><\/h2>\n\n\n\n

Masking answers what you display and store in documents. The Aadhaar Data Vault answers where a full number may live when a legitimate need exists.<\/p>\n\n\n\n

UIDAI requires entities that must retain Aadhaar numbers to keep them only in a secured, access-controlled Aadhaar Data Vault, encrypted with HSM-managed keys. Application databases hold a reference token instead of the number. Systems that need the real number for an authorised purpose exchange the token through controlled access.<\/p>\n\n\n\n

The combination is the compliant architecture: masked artefacts everywhere by default, tokenised references in application systems, and full numbers confined to the vault under audit. If your architecture has full Aadhaar numbers in an ordinary customer table, no amount of image masking fixes it.<\/p>\n\n\n\n

Remediating Legacy Records<\/strong><\/h2>\n\n\n\n

Most institutions\u2019 real Aadhaar masking problem is historical. Years of onboarding produced archives of unmasked images and columns. A defensible remediation programme has four steps.<\/p>\n\n\n\n

Inventory. Crawl document stores, databases, data lakes, and log archives for Aadhaar patterns. Expect to find them in places no policy anticipated.<\/p>\n\n\n\n

Prioritise. Rank stores by exposure: internet-facing systems and broadly accessible shares first, cold archives later.<\/p>\n\n\n\n

Mask and tokenise in place. Run the automated pipeline across the inventory, replacing artefacts with masked versions and migrating any retained numbers into the vault. Destroy superseded unmasked copies, including in backup rotation as cycles allow.<\/p>\n\n\n\n

Prove it. Keep remediation logs. Regulators respond very differently to \u201cwe found a gap and closed it with evidence\u201d than to a gap they discover themselves. This exercise pairs naturally with the broader [KYC remediation programme<\/a>] many institutions are already running.<\/p>\n\n\n\n

Key Takeaways<\/strong><\/h2>\n\n\n\n