Digital public infrastructure

The first principle

A road is built once by the public and then used by anyone to run a bus, a truck or a taxi; the road does not decide which business wins. Digital public infrastructure (DPI) applies the same idea to the digital world: the State builds or governs a few shared rails, such as identity, payments and data sharing, publishes open rules for connecting to them, and lets public and private services compete on top. Because every app speaks the same standard, each new user makes the rail more useful to everyone else, and that network effect, not any single app, is what explains India's speed.

The core

Three rails and the technology inside them

• Identity: Aadhaar. At enrolment the Unique Identification Authority of India (UIDAI) records a person's fingerprints, iris scans and face, compares them against every record already held to make sure no one is enrolled twice, and issues a random 12 digit number. Later, authentication is a one to one check: a service sends the number with a fingerprint or a one time password, and UIDAI replies only yes or no, or with basic details in electronic know your customer (eKYC), without revealing the stored biometrics.
• Payments: the Unified Payments Interface (UPI). Launched in 2016 by the National Payments Corporation of India (NPCI), UPI lets a person pay from any bank account through any app using a virtual payment address instead of an account number. The payer's bank debits the account, NPCI's switch routes the message, the payee's bank credits the money within seconds, and the banks settle what they owe one another later in batches; because every app and bank follows one standard, a payment from one app reaches a user of another.
• Data: consent based sharing. DigiLocker holds documents issued directly by departments, each signed digitally so that its origin and integrity can be checked with public key cryptography, and the Account Aggregator framework of the Reserve Bank of India (RBI) lets a person send their own financial data from a bank to a lender through a regulated intermediary that cannot read the data. The permission is a machine readable consent artefact that states what is shared, with whom, for what purpose and for how long. Together these follow the Data Empowerment and Protection Architecture (DEPA) that NITI Aayog set out in a draft in 2020.
• Platforms on top. Direct benefit transfer, CoWIN for vaccination, the Ayushman Bharat Digital Mission for health records and the Open Network for Digital Commerce (ONDC) are services built on these rails, and ONDC applies the UPI idea to trade, so a buyer on one app can order from a seller listed on another.

What makes infrastructure public

• Open standards and interfaces. Anyone who meets the rules may connect through published application programming interfaces, so a start up and a large bank use the same rails.
• Public stewardship. A public or not for profit body, such as UIDAI, NPCI or the ONDC company, sets and enforces the rules, so no private platform can lock users in.
• Minimal data and consent by design. Each rail is meant to carry only what a task needs, and the person decides when their data moves.

Dimensions

• Economic. Cheap identity checks and zero cost payments cut the cost of serving a poor customer, which made small loans, small merchants and small savings worth serving; the financial inclusion note in Economy carries this story.
• Governance. The Jan Dhan, Aadhaar and mobile (JAM) trinity, named in the Economic Survey of 2014-15, lets subsidies and pensions go straight into bank accounts, which removes duplicate and ghost beneficiaries and middlemen.
• Legal. In 2017 a nine judge bench of the Supreme Court held privacy to be a fundamental right, and in 2018 a five judge bench upheld the Aadhaar Act, 2016 for welfare but struck down the clause that let private companies demand Aadhaar.
• Social. Exclusion happens when fingerprints of manual workers or the elderly fail, when networks are down or when people cannot use a phone, so every rail needs a fallback.
• International. The G20 New Delhi Leaders' Declaration of 2023 adopted a framework for DPI, India built a global repository of DPI, and the Modular Open Source Identity Platform (MOSIP), developed at the International Institute of Information Technology Bangalore, is used by several countries including the Philippines, Morocco and Ethiopia.

In practice

• Aadhaar at scale. Aadhaar covers almost the entire population, and authentication transactions crossed a cumulative 150 billion by April 2025, with about 210 crore in that month alone, according to the Ministry of Electronics and Information Technology (MeitY).
• UPI dominates retail payments. It handled about 18,585 crore transactions worth about Rs 261 lakh crore in 2024-25 and about 24,160 crore (241.6 billion) in 2025-26, according to NPCI. A Press Information Bureau (PIB) factsheet of August 2026 put its share of world real time payment volume at about 49 per cent in 2024 and UPI or links to it are live in several countries, including Singapore, the United Arab Emirates, France, Nepal, Bhutan, Sri Lanka and Mauritius.
• DigiLocker has tens of crores of registered users and holds documents issued directly by central and State departments.
• ONDC, a not for profit company set up in 2021 at the initiative of the Department for Promotion of Industry and Internal Trade, links buyer apps and seller apps through open protocols; it has grown in food, mobility and grocery orders but remains small next to the large private marketplaces.
• The data law. The Digital Personal Data Protection Act, 2023 requires consent for most processing, gives people rights to access, correct and erase their data, sets up the Data Protection Board and allows a penalty of up to Rs 250 crore for failing to take reasonable security safeguards. Its Rules were notified on 13 November 2025, with most duties coming into force in phases over 12 to 18 months.

Issues and way forward

• Exclusion by failure. Biometric mismatch, poor connectivity and seeding errors have denied rations and wages to genuine beneficiaries, so face authentication, offline verification and a rule that no one is refused a benefit for a failed check are needed.
• Concentration on top of open rails. Two private apps carry most UPI volume, which is why NPCI has set a 30 per cent cap on any one app's share, with its deadline extended to the end of 2026; supporting more apps and bank apps is the safer path.
• Who pays for UPI. Zero merchant charges since January 2020 drove adoption but leave banks and apps without revenue, so the cost of running the rail needs a sustainable model that does not hurt small payments.
• Fraud and security. Social engineering, fake payment requests and mule accounts have grown with volume; device binding, transaction limits for new users and fraud scoring help, while the wider threat sits in the cybersecurity note.
• Surveillance risk. Linking databases can build profiles of citizens, and the 2023 Act exempts government agencies on grounds such as security of the State; independence of the Data Protection Board and purpose limits on government use are the reforms most often urged.

Common confusions

• Authentication and identification. Authentication checks a claimed identity one to one and answers yes or no, while identification searches a whole database for a match, which Aadhaar does only at enrolment to remove duplicates.
• Aadhaar and citizenship. Aadhaar is proof of identity and residence for anyone who has lived in India for 182 days in the year before enrolment, not proof of citizenship.
• UPI and a wallet. UPI moves money directly between bank accounts, while a prepaid wallet holds money that has first been loaded into it.
• Digital public infrastructure and digital public goods. DPI is the working system in a country, with its rules and steward, while a digital public good is open software or a standard, such as MOSIP, that any country can adopt to build its own.
• The Account Aggregator and a credit bureau. A credit bureau keeps a record of a person's loans, while an account aggregator stores nothing and only carries data the person agrees to share.

For the exam

• Keyword bank: digital public infrastructure, open application programming interfaces, interoperability, network effects, authentication, eKYC, virtual payment address, consent artefact, Account Aggregator, Data Empowerment and Protection Architecture, JAM trinity, data minimisation, Data Protection Board, digital public goods, MOSIP.
• Previous year questions: Practise the previous year questions on this topic →
• Use in an answer:
  • Introduction with data: UPI processed about 18,585 crore transactions worth about Rs 261 lakh crore in 2024-25 (NPCI), which shows how an open public rail can carry a country's daily payments.
  • Introduction with a source: In Justice K S Puttaswamy (2018) the Supreme Court upheld Aadhaar for welfare delivery but barred private firms from demanding it, setting the balance between efficiency and privacy that DPI must keep.
  • Conclusion: India Stack has turned identity and payments into public goods that private firms build on; the unfinished layer is data, where consent is designed but must now be protected by an independent regulator.
  • Conclusion: DPI succeeds when it stays open, inclusive and accountable, so its next test is not scale but whether the last citizen is served without exclusion or surveillance.