Privacy

Aadhaar and the right to privacy

A retired judge's petition against Aadhaar led India's Supreme Court to declare privacy a fundamental right, then to uphold Aadhaar with limits. What the two judgments decided, and what Parliament did next.

Published 13 October 2026 · Aadhaar News desk

In 2012 Justice K.S. Puttaswamy, a retired judge of the Karnataka High Court, filed a petition in the Supreme Court challenging Aadhaar. At the time the scheme had no law behind it, only an executive notification of January 2009. His case became two of the most important judgments in modern Indian law.

The question underneath

In 2015 the government argued that Indians had no fundamental right to privacy at all, relying on two old judgments, M.P. Sharma (1954) and Kharak Singh (1962). On 11 August 2015 the court ordered, as an interim measure, that Aadhaar could not be made mandatory for welfare benefits, and sent the privacy question to a larger bench.

2017: privacy is a fundamental right

On 24 August 2017 nine judges ruled unanimously that privacy is a fundamental right, protected as part of the right to life and personal liberty in Article 21 and by the freedoms in Part III of the Constitution. They overruled M.P. Sharma and Kharak Singh to the extent those cases said otherwise.¹

The right is not absolute. A law that limits it must pass a test: it must exist as law, pursue a legitimate aim, and be proportionate to that aim. That test is what the Aadhaar Act then had to pass.

2018: Aadhaar upheld, with limits

On 26 September 2018 a five-judge bench upheld the Aadhaar Act by four to one.² The majority held:

• Welfare and tax: allowed. The government can require Aadhaar for subsidies, benefits and services paid from the Consolidated Fund of India (section 7), and for filing income tax returns and holding a PAN.
• Private companies: struck down. Section 57, which let any company or person demand Aadhaar under a contract, was unconstitutional. Banks could no longer make Aadhaar compulsory to open an account, nor telecom companies for a SIM.
• Schools and exams: not required. Aadhaar could not be made compulsory for school admissions or for exams such as those run by the CBSE, NEET and UGC.
• Records: kept for less time. Authentication records could be kept for six months, not the five years the regulations allowed.

Justice D.Y. Chandrachud dissented. He held that the Act should never have been certified as a money bill, a route that let the government avoid the Rajya Sabha's amendments, and that the whole Act was therefore unconstitutional.²

The security record

The judgments came against a run of exposures. In 2017 the Centre for Internet and Society reported that Aadhaar numbers of about 13 crore people had been published through government websites for four social security schemes. On 5 January 2018 The Tribune reported that its reporters had bought access to Aadhaar details for Rs 500. UIDAI denied a breach of its database and filed a criminal complaint naming the newspaper and its reporters.

Leaks of numbers and demographic details from other people's websites are not the same as a breach of the central biometric database, and UIDAI has always drawn that line. For the person whose number and address are exposed, the distinction matters less.

What Parliament did next

• 2019. The Aadhaar and Other Laws (Amendment) Act, passed in July 2019, made using Aadhaar voluntary in law, removed section 57, and let banks and telecom companies use Aadhaar authentication or offline verification only with the customer's choice and consent, alongside passports and other documents. Making Aadhaar mandatory for any service now needs a law of Parliament.³ PRS Legislative Research keeps a plain summary of the bill.
• 2023. The Digital Personal Data Protection Act became India's first general data protection law, covering companies and government bodies that handle digital personal data.

What it means for you

• A private company cannot refuse you service only because you will not give your Aadhaar. You can offer other identity documents.
• For government benefits, Aadhaar can be required, but the 2018 judgment said children must not be denied benefits for lack of it.
• Share a masked Aadhaar or a Virtual ID instead of the full number where you can.