Aadhaar is constitutional for state welfare delivery — but mandatory commercial Aadhaar linking violates the right to privacy under Article 21.

The Legal Question Before the Court

The constitutional validity of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 was challenged on multiple grounds — including that it violated the right to privacy (established in Puttaswamy (Privacy), 2017), that it enabled mass surveillance, that the Aadhaar database was insecure, and that mandating Aadhaar for private commercial transactions (bank accounts, mobile phones, school admissions) went beyond the constitutional limits of State power. The constitution bench was asked to delineate the permissible scope of the Aadhaar scheme.

The Court's Decision

The majority (4:1) upheld the Aadhaar Act as constitutionally valid for the purpose of delivering state subsidies, welfare benefits, and services funded from the Consolidated Fund of India. The scheme, for this limited purpose, satisfies the proportionality test: the objective (targeted delivery of welfare to genuine beneficiaries, elimination of ghost beneficiaries) is legitimate, the means (biometric identification) is rationally connected to the objective, and the privacy intrusion is not disproportionate.

However, the court struck down Section 57 of the Aadhaar Act, which had permitted private entities (banks, telecom companies, schools) to use the Aadhaar database for authentication purposes. Mandatory Aadhaar linking for bank accounts and mobile numbers was held unconstitutional — the state cannot compel citizens to link their biometric identity to purely private commercial relationships.

The court also struck down the circular issued under the Prevention of Money Laundering Act (PMLA) making Aadhaar mandatory for bank account KYC, and clarified that children cannot be compelled to provide Aadhaar for school admission.

The Court's Reasoning

The majority applied the proportionality framework from Puttaswamy (Privacy) (2017). The state's interest in identifying genuine welfare beneficiaries and eliminating fraud in subsidy delivery is a legitimate aim that justifies a proportionate data collection requirement. The Aadhaar database, the majority found, is sufficiently protected with anonymisation and limited-use provisions to pass the proportionality test for welfare purposes.

However, compelling citizens to submit biometric data as a condition of maintaining a bank account or mobile phone connection goes beyond what any legitimate state interest can justify. These are not state welfare programmes; they are private commercial relationships. The state cannot use Aadhaar as a gatekeeping mechanism for private transactions, which would effectively deny citizens access to essential commercial services without submitting to biometric surveillance.

Practical Implications — What This Means Today

The Aadhaar judgment is directly relevant to India's evolving data protection framework under the DPDPA 2023. It establishes the constitutional principle of proportionality in data collection: the state (and by extension, regulated private entities) may collect only such personal data as is necessary and proportionate to a legitimate aim. Blanket, mandatory data collection requirements that exceed what is necessary for the stated purpose are constitutionally vulnerable.

For technology and data privacy clients, the ruling provides a constitutional standard against which to evaluate data collection requirements imposed by regulation or by contract. Mandatory data sharing mandates that have no rational connection to the purpose for which they are imposed, or that are disproportionately intrusive, can be challenged as violative of the privacy right established in Puttaswamy (Privacy) and operationalised in this judgment.

Relevant Statutory Provisions

  • Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 — Constitutional for welfare delivery — Section 57 struck down
  • Section 57, Aadhaar Act, 2016 — Private use of Aadhaar — struck down as unconstitutional
  • Article 21, Constitution of India — Right to privacy — proportionality test applied
  • Digital Personal Data Protection Act, 2023 — Statutory framework shaped by the constitutional principles in this case

Analysis by Vinode V. Luka, Advocate | Published: May 2026 | Last reviewed: May 2026