Digital public infrastructure

1. Meaning, architecture and related concepts

Digital public infrastructure comprises shared digital systems that provide foundational capabilities such as establishing identity, transferring money and exchanging verified information. These systems support many services rather than one department’s workflow. For example, a common identity-verification facility can support banking, welfare delivery and telecommunications. DPI resembles physical infrastructure in enabling wider economic activity, but its functioning depends on software, technical standards, institutional arrangements and enforceable rules.

Its principal design features are interoperability, modularity, scalability and safeguards. Interoperability allows different systems to communicate through agreed standards. Modularity allows a service provider to combine reusable components without rebuilding the entire system. Application programming interfaces, or APIs, specify how software components request and exchange information. An open API does not mean that personal records are openly accessible; access can still require authentication and permission.

Distinguish DPI from digital public goods and digital government. Digital public goods include qualifying open-source software, open data and other openly licensed resources. DPI may use such goods, but also requires operational institutions and governance. Digital government is broader, encompassing online certificates, departmental portals and electronic administration. Not every government application is DPI. Similarly, a private organisation may operate a DPI component when it serves a public purpose under suitable rules.

• Exam distinction: public purpose, open standards, open-source code and public ownership are different attributes, not interchangeable terms.

2. India’s identity and payments infrastructure

Aadhaar provides a unique 12-digit identity number to eligible residents. The Unique Identification Authority of India, or UIDAI, administers it under the Aadhaar Act, 2016. Authentication checks submitted identity information against UIDAI records using permitted methods such as biometrics or one-time passwords. Electronic Know Your Customer, or e-KYC, enables authorised identity verification under applicable requirements. Aadhaar does not establish citizenship, domicile or an individual’s entitlement to a particular welfare benefit.

The Unified Payments Interface, launched in 2016, enables instant transfers using identifiers such as virtual payment addresses and QR codes. NPCI operates the payment system, banks maintain participating accounts, and banks or approved third-party providers offer customer-facing applications. Thus, an application such as BHIM is not synonymous with UPI itself. UPI is neither a cryptocurrency nor the digital rupee. The latter is a central bank digital currency and constitutes a liability of the RBI.

The Jan Dhan–Aadhaar–Mobile, or JAM, approach links financial access, identity and connectivity to improve service delivery. Direct Benefit Transfer is a delivery mechanism rather than a single technology platform, and transfers can use different payment routes. Reliable beneficiary records, correct account details and accessible grievance mechanisms remain essential. A technically successful transfer does not necessarily mean that a beneficiary can easily withdraw or use the money.

• Exam distinction: authentication answers whether identity information matches; authorisation determines whether a person is permitted to access a service.

3. Data exchange, documents and sectoral applications

The data layer of DPI seeks to make information usable across institutions without assuming that all records must be pooled into one central database. DigiLocker, a Ministry of Electronics and Information Technology initiative, supports access to authentic digital documents from participating issuers. Under the applicable rules, issuer-provided documents shared through DigiLocker are treated at par with corresponding physical originals. A user-uploaded scan should not automatically be equated with an issuer-authenticated record.

The Account Aggregator framework enables consent-based sharing of financial information between participating institutions. An Account Aggregator is an RBI-regulated non-banking financial company that facilitates this exchange; it does not undertake payments or lending merely by virtue of its AA licence. Financial information providers supply specified data to financial information users under the approved consent terms. The framework is designed so that the AA does not store the customer’s financial information, reducing the need for repeated manual document submission.

Sectoral initiatives extend the building-block approach. The Ayushman Bharat Digital Mission uses components such as the ABHA health identifier, professional and facility registries, and consent-based health-record exchange. The Open Network for Digital Commerce, or ONDC, seeks interoperability between participating commerce applications through an open-network approach. It is not a single government shopping application. These systems have distinct institutional arrangements and varying maturity; a common DPI label should not obscure their differences.

• Exam distinction: consent-based exchange, a centralised database and an open-data portal represent different models of managing information.

4. Development significance and international relevance

DPI can reduce the cost of identity verification, payments and document handling. Common infrastructure allows firms and government agencies to develop services without duplicating every underlying capability. Small merchants can accept interoperable digital payments, while citizens can share verified credentials remotely. Standardised interfaces may encourage innovation and competition, although these outcomes depend on fair participation rules and viable business models.

For welfare administration, DPI can improve traceability, reduce repeated paperwork and help identify duplicate or invalid entries. However, claims about savings require careful attribution: changes may result from database cleaning, eligibility reforms or other administrative measures, not technology alone. Financial inclusion must also be measured through actual account use, affordability and effective access, rather than enrolment numbers alone. Gender gaps in phone ownership and dependence on intermediaries can limit the benefits.

During India’s G20 presidency in 2023, the New Delhi Leaders’ Declaration recognised the voluntary G20 Framework for Systems of Digital Public Infrastructure. International cooperation increasingly involves technical standards, capacity building and adaptable digital components. MOSIP, developed at the International Institute of Information Technology Bangalore, is an open-source platform that countries can adapt for identity systems. Adoption of a common platform does not mean sharing a common identity database or transferring sovereign control.

• Development relevance: SDG 9 concerns infrastructure and innovation; SDG 16.9 concerns legal identity for all, including birth registration.

5. Risks, regulation and safeguards

Population-scale infrastructure can amplify mistakes. Biometric failures, incorrect demographic information, weak connectivity and inaccessible interfaces may exclude legitimate users. Essential services therefore need alternative verification methods, assisted access and effective correction procedures. Digital-by-default delivery should not become digital-only delivery where people lack devices, connectivity or the capacity to use them.

Cybersecurity threats include phishing, credential theft, malicious applications, API vulnerabilities and attacks on service providers. Privacy risks include excessive collection, unauthorised linkage of databases and function creep, where information gathered for one purpose is reused for another. Consent must be understandable and meaningful rather than reduced to a compulsory click. Data minimisation, encryption, access controls, audit trails and retention limits help reduce exposure, but no single measure eliminates all risks.

The Supreme Court recognised privacy as a fundamental right in the Puttaswamy judgment of 2017. The Digital Personal Data Protection Act, 2023 provides a framework for processing digital personal data, with application depending on commencement provisions and notified rules. Sectoral obligations and constitutional safeguards also matter. Effective DPI governance requires accountable institutions, independent scrutiny, incident response, accessible remedies and protection against market concentration. Success should be judged by inclusion, reliability and user agency, not transaction volumes alone.

• Policy test: assess who controls the system, what data it needs, who may access it, and what remedy exists when it fails.

Previous year questions

No source-linked PYQ is available here yet. Use the practice questions below.

Practice questions