DPI Brief — May 02, 2026

Today’s DPI Updates (7 Layers)

L1: Identity & Authentication

India’s digital identity ecosystem under global scrutiny. Parliament’s public spending watchdog announced a formal inquiry into government plans for a new state-issued national digital identity, drawing lessons from the failed GOV.UK Verify programme. The UK Public Accounts Committee cited concerns similar to those applicable globally — data security, private sector access, and user consent. In India, the Aadhaar ecosystem continues to scale with over 1 billion enrollments, though the Unique Identification Authority of India (UIDAI) has not announced major policy changes this week. The question of whether government will sell public digital ID data to private companies remains a live concern in comparable jurisdictions, and India watchers will note the parallel with ongoing DPDP Act implementation. Meanwhile, Truecaller — which derives roughly 350 million of its 500 million+ users from India — faces slowing growth as India’s CNAP (Calling Name Presentation) initiative potentially disrupts caller ID services, though analysts see minimal near-term impact on core business. ¹

L2: Payments & Financial Rails

Big Tech battles for UPI market share as PhonePe and Google Pay near 80% dominance. In a significant development, Amazon Pay, WhatsApp, CRED, MobiKwik, and Flipkart’s Super.money met with NPCI on May 1st to lobby against the dominant position of PhonePe and Google Pay, which together accounted for roughly 80% of 22.6 billion UPI transactions in March 2026. The group is seeking regulatory intervention to level the playing field. The delay in implementing NPCI’s third-party app provider (TPAP) guidelines has allowed PhonePe and Google Pay to retain their dominant market position, frustrating smaller players who argue the concentration undermines competition. NPCI has been working on bringing more players into the TPAP framework, but the process has stalled. This lobbying effort reflects growing tension between Big Tech financial ambitions and India’s goal of an open, competitive digital payments ecosystem. Axis Bank also made headlines this week — its headcount fell to 1.01 lakh in FY26 (down 3,000 roles) as technology-driven productivity gains offset branch expansion, demonstrating how digital infrastructure investments are reshaping the banking workforce. ²

L3: Documents & Data Exchange

DigiLocker becomes the default credential layer for academic results. Multiple state education boards are directing students to DigiLocker for accessing examination results — UP Board Class 10th and 12th results, Karnataka SSLC, and Assam HS Class 12 results are all expected or available via DigiLocker notices. This marks a clear maturation of the document infrastructure layer: DigiLocker is no longer aspirational but operational, serving as the authoritative channel for credential verification. The platform’s integration with academic institutions eliminates the need for physical document verification in most hiring and administrative processes. API Setu continues to power backend verification APIs across government services, though no new API endpoints were announced this week. The eSign service by NIC remains active for digital document signing across revenue, banking, and regulatory filings. ³

L4: Commerce & Logistics

India-New Zealand FTA signals new trade architecture; ONDC quiet on metrics. India and New Zealand signed a free trade agreement on April 27th, aiming to deepen economic ties amid global trade disruptions. While the FTA is primarily tariff-focused, the broader digital trade architecture — including logistics, customs clearance, and digital document exchange — intersects with DPI infrastructure. On the domestic commerce side, GeM (Government e-Marketplace) continues to expand public procurement, though specific transaction data for this period is not publicly available. ONDC has not published updated metrics; the network’s GMV and transaction volumes remain elusive in public filings. India’s Snabbit, an on-demand home services startup, closed a $56M funding round — a signal that consumer-facing digital commerce beyond traditional e-commerce is attracting serious capital, with implications for last-mile service infrastructure. ⁴

L5: Sectoral Infrastructure

Census 2027 kicks off as India’s first fully digital census using self-enumeration. India’s Census 2027 has launched with self-enumeration — a first in the country’s history. Telangana, Punjab, and Delhi all began online self-enumeration in late April, with residents submitting household data through a government portal using Google Earth maps for location verification. The process generates an 11-digit Self Enumeration ID (SE ID), integrating with the broader digital identity infrastructure. Notably, 27 of 33 census questions can be answered via self-enumeration, reducing enumerator workload. Meanwhile, the National Health Authority (NHA) continues to expand ABHA (Ayush Bharat Health Account) coverage — no major ABHA announcements this week, but the health ID system remains the backbone of the Ayushman Bharat Digital Mission. On agriculture, AgriStack development continues at a state-level pace with no central-level announcements this week. ⁵

L6: Governance & Grievance

No major CPGRAMS or eOffice announcements this week. The DARPG-managed CPGRAMS (Centralised Public Grievance Redressal and Monitoring System) and eOffice infrastructure continue routine operations, though no significant policy updates or new service launches were recorded in the last 7 days. Grievance disposal rates and average resolution times from CPGRAMS are available on the DARPG dashboard. The absence of major announcements should not be interpreted as stagnation — the system handles thousands of daily grievances across central and state government departments. For the DPI Watch brief, this layer remains active but quiet for this cycle. ⁶

L7: Security, Privacy & Trust

Global cybersecurity agencies warn of Agentic AI risks; Microsoft zero-day exploited. In the most significant security development this week, cybersecurity agencies from the USA, UK, and Australia jointly warned about risks from Agentic AI systems — AI that operates autonomously and can be easily misused or breached by hackers, leading to productivity losses and compromised private information. The report states “every individual component in an agentic AI system widens the attack surface.” Meanwhile, Microsoft patched a zero-day vulnerability (CVE-2026-32202) being actively exploited by Russia’s APT28 group — a Windows Shell authentication coercion flaw that bypasses Defender SmartScreen. CERT-In issued related advisories. On the policy front, India retained its position on the U.S. Priority Watch List for intellectual property concerns, with the USTR citing gaps in enforcement, patent protection, and trade secrets. The DPDP Act implementation continues with rules being framed; the full impact on data fiduciary obligations remains under industry assessment. TRAI has been quiet this week on telecom regulation, with Reliance planning a 1.5 GW data centre cluster in Andhra Pradesh (India’s largest) representing major infrastructure investment at the intersection of DPI and AI. ⁷

Sources

• UIDAI — Unique Identification Authority of India
• NPCI — National Payments Corporation of India
• DigiLocker — Ministry of Electronics & IT
• API Setu — MeitY
• ONDC — Open Network for Digital Commerce
• GeM — Government e-Marketplace
• NHA — National Health Authority / ABHA
• Census 2027 — Office of the Registrar General
• DARPG — Department of Administrative Reforms
• CERT-In — Indian Computer Emergency Response Team
• MeitY — Ministry of Electronics & IT
• TRAI — Telecom Regulatory Authority of India