Aadhaar Exclusion (DPDP Act S.17(2))
Definition
Provision that exempts processing covered by the Aadhaar Act 2016 from the general DPDP Act regime, meaning UIDAI biometric data is governed exclusively by the Aadhaar Act.
- Provision
- DPDP Act, Section 17(2)
- Effect
- Exempts Aadhaar Act-covered processing
- Governing law instead
- Aadhaar Act 2016
- Data affected
- UIDAI biometric data
Common questions
Why carve UIDAI data out of the general DPDP Act rather than covering it there?+
The Aadhaar Act already has its own dedicated statutory regime for collecting, storing and disclosing UIDAI biometric data, so the exclusion avoids two separate laws applying conflicting rules to the same data.
Does this exclusion mean Aadhaar data has weaker protection than other personal data?+
It means Aadhaar Act rules, not DPDP Act rules, apply to that specific data. Whether that regime is stronger or weaker is a separate legal question, but the two frameworks are not simply interchangeable.
Related terms
- Adequate Country (GDPR Ch. V)
- A country that the European Commission has determined provides a level of data protection essentially equivalent to the EU's. As of mid-2026,...
- Biometric Identifier (BIPA)
- Under Illinois BIPA: a retina or iris scan, fingerprint, voiceprint, or scan of a person's hand or face geometry; distinct from 'biometric...
- Data Fiduciary (DPDP Act)
- Any person who alone or in conjunction with others determines the purpose and means of processing personal data; the DPDP Act equivalent...
- Data Protection Impact Assessment (DPIA)
- A structured risk assessment required under Article 35 before any processing that is likely to result in high risk to individuals' rights...
- Explicit Consent (GDPR)
- A higher consent standard required for special-category data processing under Article 9(2)(a): must be freely given, specific, informed, and involve an explicit...
- Per-Violation Damages (BIPA)
- BIPA's statutory damages structure: USD 1,000 per negligent violation or USD 5,000 per intentional/reckless violation; confirmed by Cothron v. White Castle (2023)...
- Real-Time Remote Biometric Identification (RTBI)
- As defined in the EU AI Act: automated identification of natural persons at a distance by comparing their biometric data to those...
- Special-Category Data (GDPR)
- Personal data revealing racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic data, biometric data for unique identification, health data,...
- Standard Contractual Clauses (SCCs)
- Pre-approved contract terms issued by the European Commission that create GDPR-compliant safeguards for cross-border data transfers to countries without an adequacy decision....