Aadhaar checks for hospitals, colleges and small firms: what changed

Hospitals, colleges and small firms often need to confirm that a patient, student or new employee is who they say they are. Using Aadhaar for this has meant getting approval and running a technical setup of your own. On 29 September, UIDAI announced changes that ease both. The rules on consent and data have not changed.

What UIDAI announced on 29 September

At Aadhaar Samvaad in Kolkata, on the 17th Aadhaar Day, UIDAI launched five initiatives. Three matter to organisations that check identity.

• The Sub-AUA/Sub-KUA (LITE) framework. Government and eligible non-government entities with low-volume needs can use the authentication setup of an existing AUA or KUA, an organisation that already runs Aadhaar authentication. You do not build your own. UIDAI says onboarding becomes simpler and faster, and its security and privacy rules still apply.
• SWIK Portal 2.0. Eligible non-government entities can send their proposal to use Aadhaar authentication through the portal directly to the concerned ministry or department.
• Face authentication for ePDS, the ration shop system. It is consent-based and contactless, for cases where fingerprints are hard to read. States and Union Territories can add it to their ePDS.

The other two are a token system for visiting UIDAI offices and a new UIDAI website.

Who this helps, and what is still unclear

The SWIK portal's procedure for private entities lists possible use cases. For health care, these include staff attendance, patient registration and checks during mediclaim processing. For educational institutions, they include student registration for admission and scholarships, and attendance of students and faculty. Your use case must still be approved: the concerned ministry reviews it, MeitY and UIDAI examine it, and the ministry notifies it in the Gazette.

The announcement does not say what counts as low volume, what an agency may charge, or how LITE fits with SWIK approval. Until UIDAI publishes those details, treat LITE as an easier route to the technology, not a way to skip approval.

What the rules still require

• Consent first. The Aadhaar Act says you must take the person's consent, or a parent's for a child, and tell them what will be shared, how you will use it, and what the alternatives are.
• A fallback. If a check fails because of illness, injury, old age or a technical problem, you must offer another workable way to identify the person.
• No Aadhaar numbers in ordinary databases. UIDAI's Circular 14 of 2025 tells requesting entities to keep Aadhaar numbers only in a separate encrypted store called an Aadhaar Data Vault. Other systems use a reference key, and a hash of the number is not allowed as that key.

All this sits on top of India's general data protection law, covered in our guide to the DPDP Act.

Questions to ask the agency or vendor

• Are you an AUA or KUA, and do you offer access under LITE? Can we have that in writing?
• Does our use case still need SWIK approval, and who files it?
• Where are Aadhaar numbers stored, and what do our own systems keep?
• How is each consent recorded, and can we produce it later?
• What happens when a check fails, and what does each check cost?

How we can help

We build the parts on your side: the consent screen in Tamil and English, the fallback at the counter, and records that hold a reference key instead of the Aadhaar number. See our services. If you are weighing an Aadhaar check for admissions, patient registration or attendance, talk to us.