With increasing reliance on digital public infrastructure for delivering governance, the landscape of fundamental rights (such as the right to privacy) has frequently witnessed lateral applications to the digital world. A recent example of the same may be seen in the judgment of the Madras High Court’s Madurai Bench dated October 17, 2025, in P. Pushpam v. Director, UIDAI & Anr. (“Judgment”).
The case involved the petitioner seeking correction of her name and date of birth in the records of the Central Identities Data Repository (“CIDR”) maintained by the Unique Identification Authority of India (“UIDAI”) under the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 (“Aadhaar Act”). The petitioner had approached multiple authorities (including the E-Sevai Maiyam, Local Post Officer and the Regional Centre, Bengaluru) with her rectification requests, but was met either with rejection, redirection or with no response at all, leading to the filing of the writ petition.
The Court examined the provisions of the Aadhaar Act with reference to its Statement of Objects and Reasons and its indispensable role today in governance, along with the Supreme Court’s observations in the Puttaswamy case. The Court’s examination included:
(a) The statutory framework under the Aadhaar Act, through which the Aadhaar holder may raise a request to alter demographic information (Section 31(1)) and biometric information (Section 31(2)) in the CIDR. The provision provides that such alterations may be made upon satisfaction of UIDAI, and an intimation to the Aadhaar number holder to be provided in the manner prescribed upon such alteration being carried out.
While the provisions of the Aadhaar Act reflect a ‘discretionary’ nature to make such alterations, the Court held that the authority is duty-bound to make corrections on being satisfied that the information set out is correct and accurate, considering that the whole purpose of the provision is to ensure that the information is accurate.
(b) The Aadhaar (Enrolment and Update) Regulations, 2016 enable (Regulation 16) the Aadhaar number holder to seek alteration of demographic or biometric information and the specific procedures and supporting documents that are to be provided for evidencing such alterations, with the update process.
In the current instance, the Court observed that the petitioner had, in fact, produced the relevant documents in support of her request for the update, on the basis of which the update request should have been considered by the appropriate authority, and the CIDR should be amended on the basis of such request.
Upon addressing and upholding the right of the petitioner, the Court examined the appropriate authority to which such a request is to be made. In this regard, the submissions revealed that while demographic updates may be made to an authority at the local level, applications for change in biometric information, name and date of birth would have to be made only at certain ‘Aadhaar Seva Kendras’. The Court proceeded to outline the current state of infrastructure associated with enrolment and update centres, and the practical difficulties faced by individuals, including traversing long distances due to the unavailability of Aadhaar Seva Kendras and other centres for the updates, especially for name and date of birth, for which the physical presence of the petitioner is not necessitated.
In this context, the Court proceeded to examine the nature of the statutory right under the Aadhaar Act to request updates or rectifications by observing that the intent of the Aadhaar Act (as suggested by its long title as well as the Statement of Objects and Reasons) is to ensure the targeted delivery of financial and other subsidies, benefits and services. It is evident, in this regard, that the ‘heart and soul’ of the said intent lies in the specific provision (Section 7) that deals with identity authentication through Aadhaar as a precondition for receiving subsidies, benefits and services which are incurred from the Consolidated Fund of India.
The Court relied on the Supreme Court’s interpretation of Section 7 in Puttaswamy, which viewed the Aadhaar Act (particularly Section 7) from the prism of social justice as a means adopted by the government to enliven fundamental rights of citizens (including socio-politico-economic equality) and the right to receive such benefits as having attained the status of a fundamental right based on the concept of human dignity.
Considering the right to receive benefits as a fundamental right and Aadhaar as a mandatory vehicle for effecting such right, the Court applied the principle of ‘Quando lex aliquid alicui concedit, coneditur et id sine quo res ispa esse non potest’ and held that Aadhaar (and an accurate and updated one) is the sine qua non of exercising the said fundamental right to receive benefits, and held that the petitioner has the concomitant fundamental right to seek alteration of demographic information in terms of the Aadhaar Act.
Beyond the ‘Aadhaar’ regime and drawing from the 2017 Puttaswamy verdict, the right to informational privacy was granted express recognition as a facet of the right to privacy. The Court observed that the right to privacy safeguards ‘individual autonomy’, recognizing the ability of the individual to control various aspects of her life, including personal data.
In this context, it is critical to note that the existing legal framework i.e., the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”) expressly calls out the right to correction as an obligation for the body corporates (Rule 5(6)). Further, the Digital Personal Data Protection Act, 2023 (“DPDPA”) also recognises the importance of accurate and up-to-date data and interlinks the requirement (Section 8(3)) to have such accurate and up-to-date data prior to sharing or taking any decisions that affect individuals (“Data Principals”). Further, the specific right of Data Principal to correct or amend their personal data has also been provided:
“A Data Principal shall have the right to correction, completion, updating and erasure of her personal data for the processing of which she has previously given consent, including consent as referred to in clause (a) of section 7, in accordance with any requirement or procedure under any law for the time being in force." (Section 13)
Therefore, it is evident that correction and erasure obligations exist beyond the Aadhaar framework and carry significant importance under existing and forthcoming legislations. The analysis in the Judgment only further buttresses the importance of such a right as a core and integral part of the ‘individual autonomy’ dome that the Puttaswamy verdict seeks to protect.
While the Judgment has been delivered in the context of a statutory authority, its reasoning resonates powerfully for businesses and data-driven organisations, especially in the context of India’s Digital Personal Data Protection Act, 2023, light of facets such as:
Right to Correction as a Compliance: Section 13 of the DPDPA grants data principals the right to correction, completion, and erasure of personal data. The Judgment’s recognition of the right of correction in the context of Aadhaar, as a fundamental right undoubtedly elevates the importance of this statutory duty for Data Fiduciaries. The requirement to treat correction requests must be correspondingly implemented and backed up with appropriate technical and organizational procedures and protocols.
Data Accuracy as a Competitive Advantage: For industries like finance, insurance, healthcare, and e-commerce, maintaining accurate and up-to-date customer data is not only a regulatory requirement but a trust-building mechanism. The Court’s reasoning underscores that data accuracy is central to informational trust, which has inherent business advantages apart from negligence amounting to breach of the law.
Accessible means for exercise of right: The Judgment also underscores the importance of having an easily accessible method of exercising the rights extended to individuals. Use of online dashboards, grievance or support systems may not only help in achieving ease in raising such requests but also make it easier to track ongoing rectification requests and resolve them as per the required timelines.
Risk of Exclusion and Discrimination: Inaccurate data can lead to algorithmic bias, wrongful denial of services, or reputational damage. For instance, incorrect KYC or demographic data could restrict access to digital credit, claims or raise flags in risk management exercises, having adverse consequences for users. The Judgment is a reminder that data errors may often have realistic human consequences.
Cultural Shift in Data Ethics: The judicial affirmation of correction as a right nudges businesses toward a rights-based data culture where accuracy, fairness, and transparency are treated as core business values, not compliance checkboxes. In the emerging privacy economy, data ethics will define corporate reputation and consumer trust.
The Judgment raises and aims to address critical questions on personal data associated rights in a pre-DPDP era, albeit being Aadhaar centric. A critical question that may arise in this regard remains as to whether the statutory rights conferred under the DPDPA (such as the right of correction and erasure) may also fall within the sine qua non for effective fulfilment of the right to privacy, including informational privacy, guaranteed by the Constitution, and if such rights may be considered statutory arms to the underlying fundamental right. While future judgments may pour meaning into the above, the Madras High Court’s judgment remains an important milestone, not just in the expansion of the fundamental rights domain, but also as a pertinent growth in the exercise of personal data-associated rights.
About the authors: Prashant Phillips is an Executive Partner, Sameer Avasarala is a Principal Associate and Abhishek Singh is an Associate at Lakshmikumaran & Sridharan Attorneys.
Disclaimer: The opinions expressed in this article are those of the author(s). The opinions presented do not necessarily reflect the views of Bar & Bench.
If you would like your Deals, Columns, Press Releases to be published on Bar & Bench, please fill in the form available here.