Digital Public Infrastructure has been called India’s most consequential tech export. Examine the architecture of the India Stack and the governance gaps highlighted by the DPDP Act 2023.
Subtopic: Sci-Tech · DPI
How to structure your answer
Introduction: UPI processed 18.4 billion transactions worth ₹24.77 lakh crore in May 2025 (NPCI data); Aadhaar enrolment crossed 1.4 billion; the India Stack now spans identity, payment, data and discovery layers.
Body: 1) Four layers — Aadhaar/DigiLocker (identity), UPI/AePS (payment), Account Aggregator/DEPA (data), ONDC/OCEN (discovery and credit). 2) DPDP Act 2023 — Data Principal rights, Consent Manager, Data Protection Board, child data norms. 3) Gaps — algorithmic accountability, deemed consent narrowness, cross-border data flow rules pending.
Way forward: Notify DPDP Rules with grievance redress; standardise Account Aggregator under RBI Master Directions; export DPI through G20 Global DPI Repository; preserve open standards via MOSIP.
Written within the word limit
230 words · target 250 words · 14 min
Introduction:
India's Digital Public Infrastructure stack — Aadhaar (138 crore IDs), UPI (16,800 crore transactions worth ₹247 lakh crore in FY25, NPCI), DigiLocker (35 crore users) and CoWIN — has been adopted across 30 countries under the G20 New Delhi Leaders' Declaration 2023 DPI compact. India's DEPA 2.0, ONDC and Account Aggregator framework form the second generation.
Architecture: India Stack is built on the JAM trinity (Jan Dhan-Aadhaar-Mobile), enabling ₹38 lakh crore DBT transfers and saving the exchequer ₹3.48 lakh crore in leakage (NeGD, 2024). The stack is layered — identity (Aadhaar), payment (UPI), data (Account Aggregator under RBI's NBFC-AA licence), and commerce (ONDC with 6.3 lakh sellers, March 2026).
Governance gaps: The Justice K.S. Puttaswamy judgment (2017) and the Digital Personal Data Protection Act 2023 establish rights but lack the operationalised Data Protection Board, which the IndiaAI Mission also relies upon. The Srikrishna Committee's deletion right and consent-manager safeguards await Rules. Deepfake threats, Aadhaar enrolment-quality issues (CAG Report 2022 noted 4.75 crore duplicate authentications), and platform exclusion of digitally-illiterate users persist.
Global exports: India has signed MoUs with Brazil, Sri Lanka, France and the African Union to export India Stack components under the Modular Open Source Identity Platform. The DPI as a global public good was anchored in the G20 framework.
Way forward:
MeitY should notify DPDP Rules and constitute the Data Protection Board by Q2 FY27, fund the IndiaAI Compute facility (₹10,372 crore), and create a DPI Safe Harbour for cross-border interoperability under the Global DPI Repository.
What an examiner expects to see
- UPI 18.4 bn transactions May 2025 (NPCI)
- Aadhaar enrolments 1.4 billion+ (UIDAI)
- India Stack — four layers identity/payment/data/discovery
- DPDP Act 2023 — Sections 6 (consent), 11 (rights), 18-26 (DPB)
- Account Aggregator framework RBI 2016, 2022
- ONDC Open Network for Digital Commerce
- G20 Global DPI Repository launched under India presidency
- MOSIP open-source identity stack
Concrete cases, schemes and judgments
- UPI launched 2016 by NPCI
- DigiLocker for academic records
- Bhashini for vernacular DPI
- PM Jan Dhan Yojana — 53 crore accounts