Lok Sabha Question No. 696 (UNSTARRED), answered on 2017-12-20
Subject: UIDAI
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: J.C. DIVAKAR REDDY

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA UNSTARRED QUESTION NO.  696

TO BE ANSWERED ON 20-12-2017

## UIDAI

## 696. SHRI J.C. DIVAKAR REDDY:

Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:

(a) whether UIDAI has a well designed, multi-layer approach and a robust security system in place and the same is being constantly upgraded to maintain the highest level of data security and integrity and if so, the details thereof and if not, the reasons therefor; and

(b)  whether  the  Government  is  conducting  security  audits  on  a  regular  basis  to  further strengthen security and privacy of data and besides this, all possible steps are taken to protect the data and if so, the details thereof and the steps being taken by the Government in this regard?

## ANSWER

## MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI ALPHONS KANNANTHANAM)

(a): Yes, Sir.  Unique  Identification  Authority  of  India  (UIDAI)  has  a  well-designed,  multilayered robust security system in place and the same is being constantly upgraded to maintain the highest  level  of  data  security  and  integrity.  UIDAI  has  adequate  legal,  organizational  and technological measures in place for the security of the data stored in UIDAI's Central Identities Data Repository (CIDR). Data Protection measures have also been mandated for the requesting entities and ecosystem partners to ensure the security of data. Government is fully alive to the need to maintain highest level of data security, privacy and is deploying the necessary technology and  infrastructure.  The  architecture  of  Aadhaar  ecosystem  has  been  designed  to  ensure  nonduplication, data integrity and other related management aspects of security & privacy in Aadhaar database.    Additionally,  various  policies  and  procedures  have  been  defined  clearly  which  are reviewed and updated periodically, thereby, appropriately controlling and monitoring security of data.

There  are  multiple  layers  of  security  at  physical  level  in  UIDAI  Data  Centres  and  is  being managed  by  armed  CISF  personnel  round  the  clock.  Strengthening  of  security  of  data  is  an ongoing process and all possible steps are being taken in this regard.

Further, Chapter VI (Protection of Information) of The Aadhaar (Targeted Delivery of Financial and  other  Subsidies,  Benefits  and  Services)  Act,  2016  ('The  Aadhaar  Act')  and  the  Aadhaar (Data Security) Regulations, 2016 framed there under have been specifically drafted keeping in account the various security requirements in respect of data stored in UIDAI-CIDR.

(b): Security  Audits  are  conducted  on  regular  basis  by  Standardisation  Testing  and  Quality Certification (STQC) Directorate, which is an attached office of the Ministry of Electronics and Information  Technology,  Government  of  India.  UIDAI  has  been  declared  ISO  27001:2013 certified  by  STQC  with  respect  to  Information  Security  which  has  added  another  layer  of information security assurance. Further, in pursuance of sub-section (1) of Section 70 of the IT

Act  2000,  UIDAI  data  has  also  been  declared  as  Protected  System  by  National  Critical Information Infrastructure Protection Centre.

*****