IRDAI's circular is the strictest wording of all: at no point in time may more than the last four digits of an Aadhaar number be stored, on paper or on disk. Proposal forms, claims files and agent uploads all carry cards, and policyholder data has been the subject of India's largest 2024 breaches.
Your AWS account
Masks inside the insurer's account before documents reach the policy system.
SaaS API
For a TPA or an agent app that needs an endpoint.
UIDAI's Sharing of Information Regulations forbid keeping Aadhaar numbers "for longer than is necessary", and Circular 14 of 2025 tells requesting entities the actual number lives in the Aadhaar Data Vault and nowhere else. A loan file that still shows the full number years later fails both.
What Aadhaar Masking does: Masked copies can be kept for the life of the loan; the vault keeps the number, the file keeps the last four digits.
The Digital Personal Data Protection Act's schedule caps the penalty for failing reasonable security safeguards at two hundred and fifty crore rupees. The 2025 Rules name "encryption, obfuscation, masking" as the minimum safeguards and give you seventy-two hours to notify the Board of a breach. Full effect: 13 May 2027.
What Aadhaar Masking does: A masked archive is a safeguarded archive; the masked copy is what a breach would expose.
The large Indian KYC exposures of 2024–25 were not live systems: they were archives. 36 million KYC files of an RBI-registered NBFC in an open storage bucket; 27 million files of a micro-lender; 4 million KYC forms of an ISP, Aadhaar copies among them.
What Aadhaar Masking does: Point the batch mode at the archive: ZIPs of up to 500 MB through the API, or a folder-in, folder-out run on your own servers, at about 500 pages a minute.
Loan files are phone photos of cards in plastic sleeves, faxed scans, rotated pages and photocopies of photocopies. Text-only tools fail quietly on them and log the page as "not an Aadhaar". Those pages are exactly where the number stays readable.
What Aadhaar Masking does: The engine looks at the page four ways round, reads each candidate twice and checks the checksum; 99.94% of numbers on real loan files, misses published.
“At no point in time, more than last four digits of the Aadhaar number of any individual should be stored by the insurers in physical or digital form.”
IRDAI circular on Aadhaar as a KYC document · Circular of 29 January 2019, as reported
Insurers may keep the last four digits and nothing more, on paper or on disk.
“Insurers shall ensure to redact or blackout the Aadhaar number as per extant PML Rules”
IRDAI Master Guidelines on Anti-Money Laundering / Counter Financing of Terrorism, 2022 · IRDAI/IID/GDL/MISC/160/8/2022, effective 1 November 2022
The same "shall ensure" duty as banks and NBFCs, written into the insurance AML guidelines.
“May extend to two hundred and fifty crore rupees”
Digital Personal Data Protection Act, 2023 · The Schedule: breach of the duty to take reasonable security safeguards, section 8(5)
An archive of unmasked Aadhaar copies is personal data without reasonable safeguards. This is the ceiling.
“within seventy-two hours of becoming aware of the breach”
Digital Personal Data Protection Rules, 2025 · Rule 7(2)(b), notice of a personal data breach to the Board
Three days to tell the Board, and every affected person must be told without delay.
Send a card photo, a scan or a short PDF and get it back masked by the production engine, with a per-page record of what was covered. Or book thirty minutes with a HabileLabs engineer to see it on your document types and plan a deployment in your AWS account.
Or email support@habilelabs.io · Monday to Friday, 10:00–19:00 IST (excluding public holidays)
