UIDAI

Who built Aadhaar? What a 2015 RTI reply showed about UIDAI's contractors

A right-to-information request in 2015 made UIDAI name the 18 companies holding 25 contracts to build Aadhaar. A law blog later cited the report in its case for a privacy law. Here is what the reply showed.

First published 28 September 2015 · Rewritten 13 October 2026 · Aadhaar News desk

Aadhaar is run by a government authority, but most of it was built by companies. In 2015 Anil Galgali, a right-to-information activist in Mumbai, asked UIDAI who they were. Its reply, dated 4 September 2015 and reported here that month, listed 18 companies that had been awarded 25 contracts under the scheme.¹

In February 2017 the NILS India Blog cited that report twice in an article by two law students arguing that India needed a data protection law before collecting biometrics at this scale.²

What the reply showed

• The money. The total outlay for the project was Rs 13,663.22 crore. By August 2015, Rs 6,562.88 crore had been spent.
• The scale. As of 24 August 2015, 90.30 crore Aadhaar numbers had been issued.
• No tender for enrolment agencies. UIDAI said there was "no tendering process" for empanelling enrolment agencies; they were empanelled under guidelines dated 19 May 2014.
• Biometric vendors. L1 Identity Solutions Operating Company received the contract for biometric solutions on 30 July 2010. Contracts for biometric authentication devices followed in early 2011, including with Sagem Morpho Security, part of France's Safran group, which also acquired L1.
• A retention clause. Clause 15.3 of the L1 contract said data "shall be retained by L1 Identity Solutions Operating Company for not more than a period of 7 years", subject to government retention policy.

The report also said the Ministry of Corporate Affairs website listed prosecution launched in 2013 against the promoters of one contractor, Sai Infosystem (India) Ltd, over bank fraud, and that it was not clear whether UIDAI had ended that contract.¹

The companies named

As listed in the RTI reply: HCL Infosystems; HP India Sales; Wipro; MAC Associates; National Informatics Centre Services Inc; Sagem Morpho Security; Totem International; Linkwell Telesystems; Sai Infosystem (India); Geodesic; ID Solutions; NISG; STQC; Telsima Communication; a group of telecom carriers (Aircel, Bharti Airtel, BSNL, RailTel, Reliance Communications, Tata Communications); Tata Consultancy Services; and Satyam Computer Services, among others.¹

Why it mattered

In 2015 there was no Aadhaar Act. The scheme ran on an executive notification of January 2009, and on 11 August 2015 the Supreme Court had ordered, as an interim measure, that Aadhaar could not be made mandatory for welfare benefits and that biometric data collected for enrolment could not be shared with other authorities.¹ A private contractor allowed to hold data for up to seven years, under a contract rather than a statute, was exactly the gap the NILS authors pointed to.²

What changed since

• The Aadhaar Act of 2016 created penalties for unauthorised access to and disclosure of identity information, and UIDAI issued data security regulations the same year.
• In 2018 the Supreme Court cut the period for which authentication records may be kept from five years to six months, and struck down private companies' right to demand Aadhaar.³
• The CAG's 2022 audit of UIDAI found that it had accepted poor-quality biometrics, producing duplicate numbers, and that its management of enrolment data was deficient.⁴
• India passed the Digital Personal Data Protection Act in 2023, the general law the 2017 article asked for.