K.S. Puttaswamy v. Union of India (Aadhaar): how a five-judge Bench upheld the Aadhaar architecture — and the Chandrachud dissent

The Supreme Court's judgment of 26 September 2018 in Justice K.S. Puttaswamy (Retd.) v. Union of India — the Aadhaar Bench, distinct from the nine-judge privacy ruling of the previous year — is the constitutional engagement with the Aadhaar architecture. A five-judge Constitution Bench of Chief Justice Dipak Misra and Justices A.K. Sikri, A.M. Khanwilkar, D.Y. Chandrachud and Ashok Bhushan heard the consolidated challenge to the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016. The Bench upheld the architecture in substantial part, with two consequential exceptions: Section 57's authorisation of private use was struck down, and Section 33(2)'s national-security carve-out was read down. Justice D.Y. Chandrachud dissented entirely — including on the Money Bill question and on the constitutional validity of the architecture as a whole.

The judgment is doctrinally consequential on three connected propositions. The first is that the Aadhaar architecture — biometric and demographic identification linked to the delivery of benefits and services — satisfies the proportionality test under Article 21 that the nine-judge privacy ruling had set down. The second is that the Aadhaar Act, 2016 was a Money Bill within the meaning of Article 110 and its passage through the Lok Sabha alone was constitutionally valid. The third is that the constitutional architecture for the use of Aadhaar by private entities was foreclosed by the Court's striking down of Section 57.

The architecture before the Bench

The Aadhaar Act, 2016 had supplied the statutory architecture for the Aadhaar identification system that the Unique Identification Authority of India had operated, prior to the Act, on the basis of executive notification. The Act provided for the enrolment of residents through the capture of biometric and demographic information, the issue of a twelve-digit Aadhaar number, and the use of the number for the authentication of identity in connection with the delivery of benefits, subsidies, and services.

The Act's principal operative provisions were:

Section 3 — entitling every resident to obtain an Aadhaar number on submitting demographic and biometric information.

Section 7 — empowering the Central Government to require Aadhaar authentication as a condition for the receipt of subsidies, benefits, or services for which the expenditure was from the Consolidated Fund of India.

Section 33 — permitting the disclosure of identity and authentication information on order of a court or on the direction of an officer not below the rank of Secretary on grounds of national security.

Section 57 — permitting any body corporate or person to require Aadhaar authentication for any purpose, subject to compliance with the Act.

Section 59 — the saving and validation provision in respect of acts done by the Unique Identification Authority of India prior to the Act's enactment.

The Act had been passed by the Lok Sabha alone, on the speaker's certification that it was a Money Bill within the meaning of Article 110 of the Constitution. The Money Bill route had bypassed the Rajya Sabha's review.

The constitutional challenge

The petitioners — including Justice K.S. Puttaswamy and a substantial body of co-petitioners — challenged the Act on multiple grounds.

The first ground was that the Act's passage as a Money Bill was constitutionally infirm. Article 110 specifies the categories of provisions that may be in a Money Bill — relating to taxation, borrowing, custody of the Consolidated Fund, appropriation, and connected matters. The Aadhaar Act, the petitioners argued, contained substantive provisions that went well beyond the Money Bill categories.

The second ground was that the architecture violated the right to privacy that the nine-judge ruling of August 2017 had recognised. The collection, storage, and use of biometric and demographic information — and the linkage with the delivery of benefits — engaged Article 21 and required justification under the proportionality test.

The third ground was that Section 57 — permitting private entities to require Aadhaar authentication — extended the architecture beyond its constitutional purpose and produced surveillance and exclusion consequences that the Constitution did not contemplate.

The fourth ground was that the Section 33 disclosure architecture — including the national-security carve-out — was constitutionally inadequate in its procedural protections.

The majority position

Justice Sikri, writing for himself, Chief Justice Misra and Justice Khanwilkar, supplied the principal majority opinion. Justice Bhushan wrote separately, concurring in the result.

On the Money Bill question. The majority held that the Aadhaar Act was a Money Bill within Article 110. The reasoning was that the dominant character of the Act — Section 7's linkage with subsidies, benefits, and services from the Consolidated Fund — was a matter within Article 110(1)(e) (any matter incidental to the matters enumerated). The other provisions were incidental to that dominant purpose. The speaker's certification of the Act as a Money Bill was, on the majority's reasoning, within the constitutional architecture.

On the proportionality test. The majority applied the four-prong proportionality test that the nine-judge privacy ruling had set down. The Aadhaar architecture, the majority held, served a legitimate State aim (targeted delivery of benefits, the reduction of leakages in welfare delivery, and the digital identification of beneficiaries); had a rational nexus with that aim (Aadhaar authentication produced reliable identification); was the least intrusive means available to achieve the aim (alternatives had been considered and found inadequate); and produced a proportionate impact on the right to privacy (the data architecture, the procedural protections, and the use limitations were held adequate).

The conclusion was that Section 7 — the principal operative provision linking Aadhaar with benefits — satisfied the proportionality test and was constitutionally valid.

On Section 57. The majority struck down Section 57. The reasoning was that the extension of the Aadhaar architecture to private entities — for purposes wholly outside the Section 7 architecture and outside the legitimate State aim that the proportionality analysis had recognised — produced an architecture that the constitutional analysis did not sustain. The use of Aadhaar by private entities had to be foreclosed.

On Section 33(2). The majority read down the national-security carve-out. The reading-down required that any disclosure under Section 33(2) involve a judicial-officer-headed oversight architecture, with procedural protections that the original section had not adequately supplied.

The connected operational rulings included the striking down of the mandatory linking of Aadhaar with bank accounts, mobile numbers, and school admissions — each of which was held to operate outside the Section 7 architecture.

The Chandrachud dissent

Justice D.Y. Chandrachud dissented entirely. The dissent operates as one of the most substantively engaged constitutional dissents of the post-ADM Jabalpur generation.

The dissent rested on three principal propositions.

On the Money Bill question. The dissent held that the Aadhaar Act was not a Money Bill. The operative provisions of the Act — the architecture of biometric collection, the use of Aadhaar in connection with services not connected to the Consolidated Fund, the data-architecture provisions — were, on the dissenter's reading, well beyond Article 110's enumeration. The speaker's certification could not, the dissent held, be a constitutionally absolute determination; the architecture of Article 110 was substantively constitutive and the certification was subject to constitutional review.

The dissent's position was that the Money Bill route had been used to bypass the constitutional architecture of Parliament's bicameral structure, and that the bypass was constitutionally infirm.

On the architecture as a whole. The dissent held that the Aadhaar architecture failed the proportionality test. The architecture's reach — into every interaction of the citizen with the State that engaged Section 7, and (under Section 57) into every interaction with private entities — produced a surveillance architecture that the constitutional protection of privacy did not sustain. The architecture's design — including the centralised database, the irrevocability of biometric data, and the exclusionary consequences for those who failed authentication — was held to fail the least-intrusive-means and proportionate-impact prongs.

On exclusion. The dissent engaged closely with the exclusion consequences — the documented cases in which Aadhaar authentication failure had produced denial of benefits, with cascading consequences. The constitutional architecture, on the dissent's reading, could not sustain an identification regime that produced systematic exclusion.

The Chandrachud dissent did not become the constitutional position. It has, however, been the substantive doctrinal contribution against which the post-2018 Aadhaar architecture has been read.

The doctrinal arc

The Aadhaar judgment sits between the nine-judge privacy ruling — K.S. Puttaswamy v. Union of India (2017) — which had recognised the right to privacy as a fundamental right, and the subsequent Digital Personal Data Protection regime.

The 2017 ruling had supplied the doctrinal frame within which the Aadhaar architecture was tested. The 2018 ruling applied that frame and reached the result that the architecture, in substantial part, satisfied the proportionality test.

The post-2018 architecture has been the subject of substantial subsequent litigation. The Aadhaar Amendment Act, 2019 — which sought to reinstate certain provisions that the 2018 ruling had restricted, including a form of voluntary use by private entities — has been engaged with in subsequent litigation. The constitutional architecture for the use of Aadhaar in tax administration, in subsidy delivery, and in financial services has continued to be developed.

The Digital Personal Data Protection Act, 2023, and the DPDP Rules, 2025, operate within a constitutional frame substantially shaped by the Puttaswamy line.

What practitioners take from the judgment today

For constitutional litigators in the privacy and identification space, Puttaswamy (Aadhaar) is the foundational authority on the Aadhaar architecture. The constitutional permissibility of biometric identification systems — and the constitutional limits of such systems — are framed by the Puttaswamy (Aadhaar) analysis.

For corporate practitioners advising clients on the use of identification systems, the judgment's holding on Section 57 has produced an architecture in which the use of Aadhaar by private entities is substantially constrained. The Section 57 striking down operates as a structural limit.

For the broader profession, the Chandrachud dissent has been the subject of substantial doctrinal commentary. The dissent's close engagement with the Money Bill question and with the proportionality analysis has shaped the post-2018 constitutional doctrinal record on those questions.

What the judgment did not decide

Three limits should be flagged.

First, the judgment did not engage with all the constitutional questions on the architecture for data storage, retention, and use that the Aadhaar regime engages. The principal engagement is with the proportionality test at the level of the architecture; the operational data-architecture questions have been engaged with in subsequent litigation.

Second, the judgment's holding on the Money Bill question has been the subject of subsequent challenges. The constitutional doctrine on the scope of the speaker's certification — and the standards under which it is subject to constitutional review — has continued to develop.

Third, the judgment did not engage with the architectural questions on the relationship between Aadhaar and the broader data-protection regime that the DPDP Act, 2023, has subsequently supplied. The frame within which Aadhaar operates after the DPDP regime is fully operational has been left for future engagement.

Related editorial pieces

• K.S. Puttaswamy v. Union of India: the right to privacy as a fundamental right
• DPDP Rules 2025: a practitioner read
• DPDP at six months: Phase-II readiness as the consent-manager regime approaches
• Selvi v. State of Karnataka: Article 20(3) and protection against involuntary cognitive extraction
• Kesavananda Bharati v. State of Kerala: the basic structure doctrine