# UIDAI AUA / KUA Compliance: Aadhaar Authentication Security Explained

> Updated 2026-06-01 - 9 min read

Organizations that use Aadhaar authentication - as Authentication User Agencies (AUA) or KYC User Agencies (KUA) - operate under strict UIDAI security and audit obligations. Because Aadhaar involves sensitive biometric and identity data, UIDAI mandates specific technical controls, information-security policies and independent audits. This guide explains what AUAs and KUAs must do to stay compliant.

## Who must comply: AUA, KUA, ASA and Sub-AUA

An AUA uses Aadhaar authentication to verify identity for its services; a KUA additionally performs e-KYC. Both connect to UIDAI's Central Identities Data Repository (CIDR) through an Authentication Service Agency (ASA). Sub-AUAs use another AUA's infrastructure.

Every entity in this chain carries UIDAI security obligations proportionate to its role - and UIDAI can audit any of them.

## Core UIDAI security requirements

- Encrypt the Personal Identity Data (PID) block at capture and never store it
- Do not store Aadhaar numbers in plain text; use reference keys / tokenization where permitted
- Maintain a UIDAI-aligned Information Security Policy and audit logs
- Restrict and monitor access to authentication infrastructure
- Secure the ASA connectivity and network segmentation of the auth environment
- Undergo periodic information-security audits by a recognized auditor

## Audits and evidence

UIDAI expects AUAs/KUAs to undergo regular information-security audits covering the authentication and e-KYC environment, with findings remediated and documented. A CERT-In-aligned audit methodology is commonly used to produce the evidence UIDAI and downstream partners expect.

## How to become UIDAI-compliant

- Scope your Aadhaar authentication / e-KYC environment and data flows
- Implement encryption, no-storage-of-PID, and access controls to UIDAI's spec
- Author a UIDAI-aligned information-security policy and logging regime
- Run an independent security audit (VAPT + configuration + policy review)
- Remediate findings and maintain an audit-ready evidence pack

## FAQ

**Can we store the Aadhaar number or biometrics?**
No. The PID block (including biometrics) must be encrypted at capture and never stored. Aadhaar numbers must not be stored in plain text; use reference keys/tokenization within what UIDAI permits.

**Do AUAs/KUAs need a security audit?**
Yes. UIDAI requires periodic information-security audits of the authentication and e-KYC environment. We deliver CERT-In-aligned audits that produce the evidence UIDAI and ASAs expect.