Does the DPDP Act require you to mask Aadhaar in your legacy archive?

Not in those exact words. No Indian rule orders an organisation to go back and mask its archive. But DPDP Rule 6(1)(a) names masking as a minimum security safeguard for personal data "in its possession or under its control," and Regulation 6(2) of the Aadhaar (Sharing of Information) Regulations 2016 binds whoever is in possession of Aadhaar numbers to keep them secure. Read together, the duty to protect what you hold is what makes masking the stored records the defensible position, even though no clause commands the remediation itself.

On or about 13 May 2027. The DPDP Rules 2025 were notified as G.S.R. 846(E) on 13 November 2025, and Rule 1 commences Rules 3 and 5 to 16, which includes the Rule 6 security safeguards, eighteen months after publication. Published legal analyses split between 13 and 14 May 2027 depending on how they read the publication date; the runway is roughly eighteen months either way.

There is no standalone RBI Aadhaar masking circular. The requirement lives in the RBI Master Direction on KYC (updated 14 August 2025): paragraph 16, Explanation 1, and paragraph 18 for Video-CIP. Both say a regulated entity must ensure the Aadhaar number is redacted or blacked out where authentication is not required, and both are capture-time duties. The PML (Maintenance of Records) Rules, Rule 9(16), carry the same duty for every reporting entity.

At the point of collection, yes, for regulated entities: the RBI KYC Master Direction and PML Rule 9(16) require the Aadhaar number to be redacted where authentication is not required. For documents you already hold, no rule says "go back and mask" in those words, but Regulation 6(2) of the Aadhaar Sharing Regulations binds anyone in possession of Aadhaar numbers to secure them, and DPDP Rule 6(1)(a) names masking as a minimum safeguard from about 13 May 2027.

Rule 6(1) lists a minimum set, and (a) spells out "appropriate data security measures, such as securing of personal data through encryption, obfuscation, masking or the use of virtual tokens." Masking is named explicitly. For a stored Aadhaar document, masking the number is the measure that fits the data, encryption protects the file at rest but leaves the number readable to anyone with legitimate access to open it.

Usually not, because retention law requires you to keep the record. DPDP Section 8(7) requires erasure only when retention is not necessary for compliance with any other law, and KYC and transaction records are held under the PMLA framework and RBI's retention rules for years. The Act's own illustration confirms a bank must retain a customer's identity record for the legally mandated period after an account closes. Masking lets you keep the record while removing the readable number.

Yes, once they are scanned. Section 3(a) applies the Act to personal data collected in digital form, and to data collected in non-digital form and digitised subsequently. A paper file only comes into scope after it is digitised, but a scanned KYC archive is digital personal data and is fully within the Act.

No. The three-year erasure timeline in Rule 8 of the DPDP Rules applies only to the classes named in the Third Schedule: large e-commerce platforms, online gaming intermediaries and social media intermediaries. No financial-sector class is listed. Banks, NBFCs and insurers stay under the general Section 8(7) erasure duty, subject to the statutory retention carve-out.

The DPDP Act's Schedule sets a ceiling of up to ₹250 crore for a failure to take reasonable security safeguards that results in a personal data breach, and up to ₹200 crore for failing to notify one. These are statutory maximums, not fines being imposed today, the Rules commence around May 2027 and the Data Protection Board and penalty provisions are notified separately. Aadhaar-specific exposure also runs to up to ₹1 crore per contravention under Section 33A of the Aadhaar Act.

Whoever is in possession of it. Regulation 6(2) of the Aadhaar (Sharing of Information) Regulations 2016 places the duty to secure Aadhaar numbers on "any individual, entity or agency" in possession of them, and DPDP Section 8(5) puts the security duty on the Data Fiduciary that controls the data. That reaches large enterprises and SMEs, and business correspondents and outsourcing partners who retained copies, not only the principal institution.

No, and it is worth being honest about that. The express Aadhaar redaction duties, PML Rule 9(16) and RBI's KYC Master Direction, are capture-time and are drafted as the entity ensuring the customer redacts at submission. The case for remediating the archive rests on the duty to secure Aadhaar you are in possession of, plus the DPDP masking safeguard from 2027, not on a standalone remediation order. Any vendor citing such an order is overstating the law.

No standalone masking mandate for scanned images was found in the instruments reviewed. UIDAI's Aadhaar Data Vault circulars govern the Aadhaar number held as data, not the number printed on a stored image. The obligation on stored images flows from the duty to secure Aadhaar in your possession and from DPDP Rule 6, and the Government has separately stated that a stored copy should have the number "redacted/masked and irretrievable." Cite the possession and security duties, not a circular that does not say this.

On-premise, in bulk, with an audit trail. The pattern that works is a pilot on a real sample of your documents to measure throughput and leak rates, then a sized rollout on CPU servers inside your network, so the unmasked archive never leaves your perimeter. The full treatment, including how the engine finds Aadhaar-bearing pages inside whole loan files on its own, is on the bulk Aadhaar masking page.