DPI Deep Dive — Monday | October 12, 2026

Focus layer: L1 — Identity & Authentication (UIDAI, Aadhaar, eKYC) · Coverage period: 5–12 October 2026 (08:30 IST to 08:30 IST)

This was a quieter week for new Aadhaar rules than for official service messaging. UIDAI promoted two app-based tasks; an NTA parliamentary report showed why identifying an exam candidate does not secure an examination; new professional-registration rules describe a separate digital identity; and India Post reported Aadhaar activity alongside payments and benefit delivery. The distinction matters: an agency post, a measured transaction count, a regulation, and a committee recommendation are different kinds of evidence. None should be presented as proof that a service works reliably for every resident.

1. Email updates move into the app’s pitch—but UIDAI’s own instructions lag

On 10 October, UIDAI promoted an Aadhaar App flow for updating an email address, describing OTP verification and face authentication and saying the service would be free through 31 December 2026. The next day, it posted a broader invitation to use the app for Aadhaar services. These are official service messages, not a dated release explaining when the email workflow went live, who can use it, or what happens when either verification step fails.¹

There is a material documentation mismatch. UIDAI’s Aadhaar App FAQ, last updated on 18 September, says that only mobile-number and address updates are then available directly in the app; a separate answer says email updates are not available through it and directs residents to an Aadhaar Seva Kendra or update centre. The FAQ predates the 10 October post, so it may simply be stale—but the newer post does not resolve that conflict with a step-by-step procedure or a revised FAQ.²

That is more than a copy-editing problem. Email is a contact detail attached to an identity record; residents need to know exactly which field is changing, how the new address is verified, and how to recover if a check fails. The app’s listed onboarding requirements—an internet-connected, compatible smartphone, Aadhaar number, face authentication and a six-digit PIN—also make “a few taps” conditional on access to a suitable device and a successful verification.²

The right test is not the number of promotional posts or downloads. UIDAI should bring the FAQ into line with the live service and publish the exact eligibility, charges, verification sequence, processing time, failure route and receipt/tracking method. Until those public instructions agree, the post is evidence of what UIDAI is advertising, not a complete service specification.

2. Reporting a death is identity hygiene; wrongful deactivation needs equal visibility

UIDAI used its official account on 5 and 10 October to remind families to report a death through myAadhaar. The online service itself is not new: UIDAI announced it in June 2025 for deaths registered through the Civil Registration System in 24 States and Union Territories at that time. The posts do not give a current coverage map, processing time, or a fresh figure for reports completed during this week.³ The date-matched development is renewed public guidance, not a new death-reporting launch.

The purpose is legitimate: an identity number that remains active after its holder dies can be misused. In a February 2026 answer to Parliament, the government said UIDAI had deactivated more than 2.5 crore Aadhaar numbers of deceased persons. That is the government’s cumulative administrative figure, not a count of fraud prevented, and it does not tell us how many families completed the online reporting step or how long verification took.⁴

There is a corresponding error risk. UIDAI’s July 2025 circular sets out a process for reactivating a number when a living holder was wrongly recorded as deceased, including a request to a UIDAI Regional Office. A system that asks families to help close an identity record should make the correction route just as visible as the reporting route. Otherwise, the person wrongly marked deceased may discover the problem only when trying to use an identity-linked service.⁵

The cross-layer stakes reach welfare and payments, but Aadhaar deactivation should not be casually equated with the lawful cancellation of an entitlement. UIDAI’s posts do not explain how the death report is matched, how a disputed match is challenged, or how affected agencies are notified. Publish those steps, the states covered, aggregate false-report corrections and turnaround times. A clean register and a reversible mistake process are both parts of trustworthy identity management.

3. India Post’s counters remain part of the identity layer

A 9 October release from Maharashtra Circle placed Aadhaar work inside a wider postal and financial-services network. It reported 8.37 lakh Aadhaar enrolments and updates, without splitting the two activities, and said special Ganeshotsav night camps had completed 570 Child Enrolment Lite Client transactions. Those are Maharashtra Circle figures, not national totals; the release’s account figures are measured as of 30 September or over FY 2026–27 through that date, so they are context reported during the week rather than transactions newly generated in the seven-day window.⁶

The same release reported 1.92 crore India Post Payments Bank accounts and 1.14 crore DBT beneficiaries for the Circle. It described a service chain spanning Aadhaar-based e-KYC, AePS, UPI and direct benefit transfers, with planned “Dak Chaupals” intended to bring savings, insurance and Aadhaar services closer to residents. This is a useful corrective to the idea that identity infrastructure is only an app or a central authentication server: enrolment, demographic updates, assisted service and the point where a person seeks money all depend on physical access and operational staff.

But the headline counts do not establish quality or inclusion. The release does not break Aadhaar activity down by enrolment versus update, location, age, authentication success, correction, or grievance. Nor does the overlap among IPPB accounts, DBT beneficiaries and Aadhaar transactions show that an individual transaction succeeded end to end. The useful next disclosure would connect service volumes to outcomes while protecting personal data: how many enrolment/update requests were completed, rejected or still pending, and where can a resident resolve a mismatch without repeated travel?

This also connects L1 to L2. AePS can make a local banking point more accessible, but any biometric or account-link failure at that point is a service-delivery problem, not merely an identity statistic. Postal reach is valuable precisely because digital identity still needs accessible human and physical fallback.

4. A professional UID is not Aadhaar—and should not be treated as one

On 7 October, the Health Ministry described a digital registration framework for allied and healthcare professionals: State and Central registers, an integrated online system, a unique identification number, QR-coded registration certificates and public verification of registration status. The underlying Registration of Allied and Healthcare Professionals Regulations had already appeared in the Gazette on 15 September. So the week’s item is the government’s explanation of the framework, not a regulation newly made on 7 October.⁷

The design is purpose-specific. The UID identifies a professional’s registration under the NCAHP framework; the release does not say it is an Aadhaar number, that it is issued by UIDAI, or that Aadhaar is required to verify a practitioner. The registers are meant to connect a regulated qualification and permission to practise with a check that patients or employers can perform. The regulations provide for five-year registration, renewal tied to continuing professional development, and central registration where a State or Union Territory lacks a functional State Council.⁷

That separation is useful: a country does not need to collapse every professional credential into its universal resident identity. But a public register and a QR code make data governance concrete. The release says prescribed particulars will be public, yet does not enumerate them or show that the portal is live. The implementation should say exactly what a scan reveals, how incorrect entries are corrected, how a registration is suspended or restored, and how public verification avoids exposing unnecessary personal information. A credential is trustworthy when the issuing authority, current status and appeal path are clear—not merely because the certificate is digital.

5. The NTA report draws the line between identifying a candidate and securing an exam

The 382nd report of the Parliamentary Standing Committee on Education was presented on 9 October. It notes that NTA has used biometric authentication, mobile jammers and AI-based CCTV analysis, but says cancellation of NEET (UG) 2026 despite those measures shows that further procedural and institutional reforms are needed. The report does not say biometric authentication caused the cancellation or failed to match a candidate; it shows that identity checks are only one control in a much larger examination system.⁸

That distinction is basic but often lost in DPI claims. A biometric check can help establish that the person at a gate is the person enrolled for an exam. It cannot, by itself, prove that questions stayed confidential, that contractors were screened, that a testing centre was secure, or that a grievance will be investigated. The Committee’s proposed remedies target those other links: a continuously updated question bank, setting final papers close to the exam, a public national register of disqualified examination vendors, a secure complaint channel and an independent body able to audit security and investigate candidate grievances.⁸

Its CBT recommendation has the same two-sided character. The Committee favours moving NEET towards computer-based testing, but says this must be preceded by investment in secure government-run capacity—including the earlier expert committee’s 1,000-centre proposal—and measures for rural and marginalised students. It calls for an independently audited, published score-normalisation method before a multi-session exam moves online. Digital delivery can reduce the risk of printed papers being transported; it also shifts security and access questions to hardware, connectivity, software, vendors and the quality of normalisation. The report is explicit that new infrastructure is not automatically inclusive or secure.⁸

For the identity layer, the practical lesson is to minimise what candidate verification collects, keep identity data separate from answer records where feasible, and report authentication failures and manual resolutions. For the wider DPI stack, the Committee’s independent audit and grievance proposals matter as much as the biometric checkpoint. Exam integrity is a chain; Aadhaar-like authentication can secure one link, not certify the whole chain.

What to watch

The week’s strongest identity signal is a shift from “Can the system match this person?” to “Can people manage their record, correct a mistaken status and complete the service?” UIDAI’s email-update message needs a matching, current procedure; death reporting needs visible error correction; the postal channel needs outcome data, not only throughput. NCAHP demonstrates that professional credentials can be governed as a distinct, sectoral register, while the NTA report is a reminder that identity verification cannot replace institutional security.

Over the next week, watch for three concrete disclosures: a refreshed UIDAI FAQ confirming whether email updates are live in the Aadhaar App; current states covered and correction timelines for death reports; and a public NCAHP register/portal with clear data fields and appeal routes. Across all five stories, the cross-layer measure should be a completed, contestable and accessible transaction—not authentication, enrolment, downloads or QR scans counted as ends in themselves.