The Digital Public Infrastructure stack of Aadhaar, UPI and DigiLocker has been called India’s most consequential tech export. Examine the architecture of India Stack and the governance challenges posed by the DPDP Act 2023.

Introduction:

Aadhaar enrolments reached 1.4 billion by 2025 (UIDAI); UPI processed 18.4 billion transactions in March 2025; the G20 New Delhi Declaration (September 2023) endorsed Digital Public Infrastructure (DPI) as a development paradigm — making India's stack the most consequential tech export of the decade.

India Stack architecture:

The stack is layered. Identity rests on Aadhaar and e-KYC. Payments include UPI, AePS, and Bharat Bill Pay. The data layer is Account Aggregator (live 2021) and DigiLocker. Sectoral applications include the Ayushman Bharat Digital Mission (ABDM) — 76+ crore ABHA IDs by 2025 — ONDC (Bengaluru pilot 2022), OCEN credit rails, AgriStack pilots in six states, and Bhashini for language AI.

DPDP Act 2023 governance:

The Digital Personal Data Protection Act, notified on 11 August 2023, mandates notice and consent, creates a Data Protection Board, and exempts State processing under Section 17 for sovereign-function purposes. Children's consent threshold sits at 18 years, with safeguards for persons with disabilities.

Governance gaps:

DPDP Rules remained pending operationalisation through much of 2024-25, delaying grievance redress timelines. Aadhaar exclusion has been documented (research by Reetika Khera) where biometric failures denied entitlements. Section 17 exemptions risk a State carve-out wider than the Justice K.S. Puttaswamy (2017) proportionality test envisaged.

Way forward / Conclusion:

Notify DPDP Rules with mandatory redress timelines, strengthen Data Protection Board independence, audit Aadhaar exclusion outcomes, and export India Stack via MOSIP partnerships (already in 12+ countries) under MeitY by 2027.