A hotel, employer, telecom provider, financial company, delivery platform or other private business may ask you for Aadhaar as identity proof. That request often creates two different questions: are you legally allowed to share it, and does the company have the right to insist on it?
Yes, you can voluntarily share or use your Aadhaar with a private company for a lawful purpose in India. However, a private company cannot automatically demand Aadhaar in every situation, and its collection, verification, use, storage and sharing of Aadhaar information are subject to legal restrictions.
In many situations, you may also have an alternative way to establish your identity.
Can Aadhaar Be Given to a Private Company?
Yes.
The Aadhaar Act permits an Aadhaar number holder to voluntarily use Aadhaar to establish identity in accordance with the law.
Depending on the permitted verification process, Aadhaar may be used through methods such as:
- Aadhaar authentication;
- Offline verification;
- Aadhaar Secure QR Code;
- e-Aadhaar;
- mAadhaar;
- Aadhaar Paperless Offline e-KYC; or
- A physical Aadhaar document verified in the prescribed manner.
The important words are voluntary, lawful purpose and proper verification.
Simply because a company is privately owned does not make every Aadhaar transaction illegal.
Can a Private Company Force You to Give Aadhaar?
Not merely because the company prefers Aadhaar.
The Aadhaar Act provides that mandatory Aadhaar authentication for providing a service must have the backing of a law made by Parliament.
For voluntary authentication, an Aadhaar holder must be informed about alternate and viable means of identification, and service should not be denied merely because the person refuses or is unable to undergo Aadhaar authentication where an alternative identification method is applicable.
Therefore, a private company should not casually claim:
“Aadhaar is compulsory because it is our company policy.”
Whether Aadhaar can legally be required depends on the particular service and the law governing it.
What Does “Voluntary Aadhaar” Actually Mean?
Voluntary use does not simply mean that you handed over your Aadhaar because an employee asked for it.
Informed consent is an important part of the framework.
Before authentication, the requesting entity is required to inform the Aadhaar holder about matters such as:
- Nature of information that may be shared;
- Purpose for which the information will be used; and
- Alternative means of identification.
The entity must obtain the individual’s consent in the prescribed manner.
This helps ensure that Aadhaar is not collected merely because it is convenient for the company.
Can a Private Company Take a Photocopy of Aadhaar?
A physical Aadhaar document can be voluntarily used for a lawful identity-verification purpose, but simply collecting an unverified photocopy should not be confused with proper Aadhaar verification.
Under UIDAI’s offline-verification framework, an entity accepting Aadhaar in physical or electronic form for offline verification must verify the digital signature contained in the Aadhaar Secure QR Code or applicable electronic Aadhaar data.
Therefore, businesses should not treat piles of Aadhaar photocopies as an informal identity database.
If a company only needs to establish identity, ask why a permanent photocopy is necessary and whether a less intrusive verification method is available.
What Is Offline Aadhaar Verification?
Offline verification allows identity to be established without sending the Aadhaar number and biometric information to UIDAI’s Central Identities Data Repository for authentication.
Depending on the permitted method, this can involve:
- Secure QR Code;
- e-Aadhaar;
- mAadhaar; or
- Aadhaar Paperless Offline e-KYC.
UIDAI’s framework regulates entities that perform offline Aadhaar verification.
A registered Offline Verification Seeking Entity, or OVSE, can collect and store verifiable credentials shared by an Aadhaar holder where the required explicit consent is obtained and applicable requirements are followed.
Can a Company Store Your Aadhaar Details?
A company’s ability to store Aadhaar-related information is not unlimited.
The Aadhaar framework places restrictions on how authentication and offline-verification information may be used and retained.
For example, information collected for verification should be used only for the purpose communicated to the Aadhaar holder.
Under the current offline-verification framework, a registered OVSE may store permitted offline Aadhaar data with the Aadhaar holder’s consent and subject to UIDAI’s security requirements.
The Aadhaar holder may also revoke consent for such storage in circumstances covered by the regulations, following which the OVSE is required to delete the offline Aadhaar data in a verifiable manner and provide acknowledgment.
Can a Company Use Your Aadhaar for Another Purpose?
Not simply because you provided it once.
Section 29 of the Aadhaar Act restricts the use and disclosure of identity information available with requesting entities and offline verification-seeking entities.
Information should not be used for purposes other than those communicated to the individual when it was submitted for authentication or offline verification.
For example, providing Aadhaar for legitimate identity verification should not automatically be treated as permission to:
- Publish the Aadhaar online;
- Use it for unrelated marketing;
- Share it indiscriminately with other companies;
- Create unrelated customer profiles; or
- Use it for another undisclosed verification purpose.
Purpose limitation is an important part of Aadhaar protection.
Can a Private Company Publish Your Aadhaar Number?
A company should not publicly display Aadhaar information simply because you provided the document to it.
The Aadhaar Act restricts public publication, display or posting of an Aadhaar number, demographic information or photograph collected or created under the Act except as permitted under the regulatory framework.
Businesses should therefore take particular care with documents uploaded to:
- Public websites;
- Employee directories;
- Customer portals;
- Publicly accessible cloud folders;
- Social-media pages; or
- Unsecured databases.
An Aadhaar copy should not be treated like an ordinary promotional document.
Should You Give Aadhaar to a Hotel?
Do not assume that Aadhaar is the only acceptable hotel identification document merely because reception asks for it.
If another legally acceptable identity document satisfies the hotel’s verification requirements, you can ask whether that alternative is accepted.
If you do provide Aadhaar, the business should use it only for the legitimate purpose for which it was collected and handle the information securely.
A hotel employee’s preference for Aadhaar does not itself create a nationwide statutory requirement that every hotel guest must provide Aadhaar.
Can an Employer Ask for Aadhaar?
An employer may have legitimate reasons for requesting identity information, particularly where statutory employment, payroll or social-security processes are involved.
But an employer should distinguish between:
- A statutory requirement;
- Voluntary identity verification; and
- Internal company preference.
Employees should be told why Aadhaar is required and how it will be used.
An employer should not collect Aadhaar information unnecessarily merely because it is an easily available identification document.
Can Banks and Telecom Companies Use Aadhaar?
Aadhaar can be used in permitted KYC and authentication frameworks, but the legal position changed significantly after the Supreme Court’s Aadhaar judgment and subsequent 2019 amendments.
The earlier broad statutory basis allowing private entities to demand Aadhaar authentication was removed.
The present framework permits Aadhaar use subject to statutory conditions, informed consent and applicable sector-specific laws.
Therefore, the correct question is not simply whether the company is a bank, telecom provider or private business. The applicable KYC law and authorised Aadhaar-verification mechanism must also be considered.
Is It Safer to Use Masked Aadhaar?
Where a full Aadhaar number is unnecessary, Masked Aadhaar can reduce unnecessary exposure.
A Masked Aadhaar hides the first eight digits of the Aadhaar number and displays only the last four digits while retaining other relevant information.
It can be useful where the recipient merely needs an identity document and accepts the masked version.
However, whether it is sufficient depends on the verification process involved.
Do not alter the Aadhaar document yourself. Use the official UIDAI facility where Masked Aadhaar is appropriate.
Should You Write the Purpose on an Aadhaar Photocopy?
Where a business genuinely requires a photocopy and accepts a marked copy, writing the specific purpose and date can be a useful practical precaution.
For example:
“Provided to ABC Company only for customer verification – 9 October 2026.”
This does not replace the company’s legal obligations or make an otherwise improper collection lawful, but it can help document the limited purpose for which you supplied the copy.
Avoid covering the QR code or other information necessary for legitimate verification if the organisation needs to verify the document.
Should You Share Aadhaar Through WhatsApp?
Only when genuinely necessary and when you are confident about the recipient and purpose.
Sending an Aadhaar image through an informal communication channel can increase the possibility of:
- Accidental forwarding;
- Unauthorised storage;
- Account compromise;
- Identity fraud; or
- Reuse for unrelated purposes.
Where the company provides a secure official verification portal, that is generally preferable to sending identity documents to an unknown employee’s personal WhatsApp number.
Also consider whether Masked Aadhaar or another identity document would satisfy the requirement.
Should You Ever Share Aadhaar OTP or Biometrics?
Treat Aadhaar OTPs and biometric authentication very differently from an ordinary photocopy.
Do not provide an OTP merely because somebody already knows your Aadhaar number.
Before approving an Aadhaar authentication request, understand:
- Which organisation initiated it;
- What service you are requesting;
- Why authentication is required; and
- What information will be returned.
Never allow an unknown person to use your fingerprint, iris information or OTP for an unexplained authentication transaction.
What If a Company Says Aadhaar Is Mandatory?
Ask three simple questions:
- Why is Aadhaar required?
- Which law makes Aadhaar mandatory for this service?
- What alternative identity document can I provide?
If the company is relying on a statutory requirement, it should be able to identify the applicable requirement.
If Aadhaar is being requested voluntarily, the consent and alternative-identification requirements become important.
Do not assume that a form containing an asterisk next to “Aadhaar Number” proves that Aadhaar is legally compulsory.
What If a Company Misuses Your Aadhaar?
If you believe your Aadhaar information has been misused:
- Preserve emails, messages and documents showing when it was provided.
- Record the purpose for which you originally gave it.
- Ask the company to explain the use or disclosure.
- Review relevant Aadhaar authentication history where applicable.
- Contact UIDAI where the issue concerns Aadhaar authentication or misuse.
- Contact the relevant bank or service provider immediately if financial fraud is involved.
- Report cyber or identity fraud to the appropriate authorities where necessary.
Act quickly if you receive an Aadhaar authentication OTP or notification for a transaction you did not initiate.
How Can You Share Aadhaar More Safely?
Before giving Aadhaar to a private company:
- Ask why Aadhaar is required.
- Check whether another identity document is accepted.
- Use Masked Aadhaar where appropriate.
- Prefer official and secure upload channels.
- Avoid sending Aadhaar to personal WhatsApp numbers unnecessarily.
- State the purpose on a photocopy where appropriate.
- Never casually share Aadhaar OTPs.
- Do not provide biometrics for an unexplained transaction.
- Check that the company is performing legitimate verification.
- Avoid giving unnecessary copies.
- Keep a record of where and why you shared Aadhaar.
- Report suspicious authentication activity promptly.
Sharing Aadhaar with a private company is therefore not inherently illegal, but neither does a private company have an unrestricted right to demand, store or reuse it. The safest approach is to provide Aadhaar only where there is a clear lawful purpose, understand whether the request is mandatory or voluntary, use the least amount of identity information necessary and make sure the company follows the prescribed verification process.
FAQs
Q1. Can a private company legally ask for my Aadhaar card?
A: Yes, a private company can request Aadhaar for a lawful purpose under an applicable Aadhaar verification framework. But a request does not automatically mean Aadhaar is legally compulsory. Where its use is voluntary, informed consent and alternative identification requirements are important.
Q2. Can I refuse to give Aadhaar to a private company?
A: In many voluntary verification situations, you can ask to use an alternative viable identification method. However, Aadhaar authentication can be mandatory where a law made by Parliament specifically requires it for the relevant service.
Q3. Is it safe to give a photocopy of Aadhaar to a company?
A: Aadhaar should be shared only where genuinely necessary. Ask why the copy is needed and how it will be protected. Consider Masked Aadhaar or another permitted verification method where appropriate, and avoid unnecessary distribution of full Aadhaar copies.
Q4. Can a company keep my Aadhaar data permanently?
A: A company does not receive an unlimited right to retain Aadhaar information merely because you supplied it once. Storage and use depend on the applicable Aadhaar framework, purpose, consent and security requirements. Under the regulated offline-verification framework, consent to storage can also be revoked in applicable circumstances.
