DigiLocker
DigiLocker is a secure cloud-based platform developed by the National eGovernance Division (NeGD) under the Ministry of Electronics and Information Technology (MeitY), Government of India, as part of the Digital India programme, designed to enable citizens to store, access, share, and verify authentic digital documents and certificates in a paperless environment.[1]
Launched to the public on 1 July 2015 by Prime Minister Narendra Modi after a beta rollout in February 2015, it integrates with Aadhaar for secure authentication and provides URI links to issuer-held e-documents from government departments, thereby minimizing the need for physical copies and facilitating efficient verification.[2][3]
By mid-2025, DigiLocker had amassed over 53 crore registered users and issued hundreds of crores of documents, underscoring its role in advancing digital empowerment and governance efficiency amid India's push towards a digitally enabled society.[4][5]
History
Launch and Early Implementation (2015–2016)
The beta version of DigiLocker was released on 10 February 2015 by the Department of Electronics and Information Technology to enable secure digital storage of personal documents linked to Aadhaar numbers. This initial rollout focused on providing citizens with a platform for uploading and accessing self-attested documents, emphasizing authenticity verification through Aadhaar-based e-signatures and minimizing reliance on physical copies.[2] By June 2015, the beta had attracted over 250,000 registrations, with users uploading documents for basic storage and sharing.[6] The public launch occurred on 1 July 2015, officiated by Prime Minister Narendra Modi as a core component of the Digital India program, allocating initial storage of 100 MB per account.[7][8] Early implementation prioritized integration with select government issuers for direct document issuance into lockers, such as educational certificates and driving licenses, while ensuring compliance with the Information Technology Act for legal validity of digital equivalents.[9] The platform's architecture supported URI-based document access, allowing service providers to verify originals without physical submission. During 2016, user adoption accelerated, reaching over 2 million accounts by mid-year and exceeding 4 million by November, alongside a growing repository of issued documents.[9][10] Implementation efforts included proposals for broader integrations, such as PAN card linkage to streamline tax-related verifications, reflecting initial steps toward ecosystem expansion despite challenges in issuer onboarding and public awareness.[11] Storage limits were later expanded to 1 GB to accommodate demand, underscoring adaptive refinements in the platform's scalability.[10]Expansion under Digital India (2017–2020)
During the period from 2017 to 2020, DigiLocker experienced accelerated growth as a core component of the Digital India initiative, which emphasized digital infrastructure and e-governance to enable paperless services across sectors. The platform's user base expanded significantly, reaching 38 million registered users by 2020, driven by increased awareness campaigns, simplified Aadhaar-linked onboarding, and broader integration with government departments for document issuance and verification.[12] This growth reflected the initiative's focus on leveraging existing digital identities like Aadhaar to scale secure document storage, reducing administrative burdens and promoting efficiency in public service delivery. A pivotal policy advancement occurred on August 10, 2018, when the Ministry of Electronics and Information Technology notified that electronic documents stored in DigiLocker hold the same legal validity as original physical documents, provided they are issued by registered issuers through the platform.[13] This gazette notification, aligned with Digital India's paperless governance pillar, encouraged greater adoption by mitigating concerns over authenticity and legal recognition, leading to expanded use in sectors such as education, transport, and finance for processes like admissions, license renewals, and KYC compliance. Key integrations further bolstered the platform's utility during this phase. In 2019, the Employees' Provident Fund Organisation (EPFO) enabled the digital issuance of Pension Payment Orders (PPOs) directly into DigiLocker, allowing pensioners to access and share these documents seamlessly via the app or website.[14] Additionally, DigiLocker was integrated into the Unified Mobile Application for New-age Governance (UMANG) platform, launched under Digital India in 2017, facilitating unified access to over 1,200 government services including document pulls from DigiLocker.[5] These developments increased the number of participating issuers—such as regional transport offices for driving licenses and educational boards for certificates—contributing to a repository that supported verification for an expanding array of over 400 document types by the end of the period. The expansion also involved technical enhancements, such as API-based pull and push mechanisms for real-time document exchange between issuers, requesters, and users, which streamlined workflows for entities like banks and insurers under Digital India's service delivery goals. By 2020, these efforts had positioned DigiLocker as a foundational tool for digital empowerment, with cumulative document issuances supporting millions of transactions amid the initiative's push for inclusive digital access, though challenges like rural internet penetration limited full-scale penetration.[15]Recent Milestones and Integrations (2021–2025)
In February 2021, the Insurance Regulatory and Development Authority of India (IRDAI) issued Circular No. IRDAI/INT/CIR/DGLKR/030/02/2021, mandating insurers to integrate their IT systems with DigiLocker for issuing digital insurance policies directly to policyholders' accounts, thereby facilitating paperless delivery and reducing physical document handling.[16] This integration aimed to lower operational costs, minimize delivery complaints, and enhance customer access to policy documents via the platform's secure ecosystem. On March 19, 2025, the Securities and Exchange Board of India (SEBI) released Circular No. SEBI/HO/OIAE/OIAE_IAD-3/P/CIR/2025/32, titled "Harnessing DigiLocker as a Digital Public Infrastructure for Reducing Unclaimed Assets in the Indian Securities Market," enabling investors to fetch and store demat account statements, mutual fund holding statements, and related records in DigiLocker starting April 1, 2025.[17] This measure targeted unclaimed assets in the securities market by streamlining verification and access, complementing existing DigiLocker support for bank statements, insurance policies, and National Pension System records.[18] A major expansion milestone was achieved on August 31, 2025, when the National e-Governance Division (NeGD) under the Ministry of Electronics and Information Technology completed pan-India integration of nearly 2,000 e-government services across DigiLocker and e-District platforms, encompassing citizen certificates, welfare scheme enrollments, utility payments, and administrative approvals.[19] This rollout, part of the Digital India initiative, standardized service delivery through API-based interoperability, enabling seamless document pull and verification nationwide while bolstering transparency and reducing bureaucratic delays.[20]Technical Architecture
Core Components and Document Handling
DigiLocker's architecture employs a modular, microservices-based design that balances centralized control with flexibility for scalability and resilience.[21] The primary components consist of the DigiLocker Portal, which serves as the user-facing interface for registration, access, and management; repositories for secure storage of electronic documents; and access gateways that facilitate integration between issuers and the platform.[21] [22] These elements interconnect via APIs to enable seamless data flow among citizens, issuers (government departments or authorized entities), and requestors (third parties needing verification).[22] Document handling begins with issuance, where authorized issuers push authentic e-documents directly to a user's Aadhaar-linked locker using standardized APIs, ensuring tamper-proof delivery through digital signatures and unique identifiers.[23] [22] Users can also upload self-scanned or self-attested documents to a dedicated "DigiLocker Drive" section, limited to supported formats such as PDF, JPEG, and PNG, with metadata for categorization.[24] Storage occurs in certified repositories, which maintain document integrity via public key infrastructure (PKI) and unique URIs for retrieval.[21] [23] Sharing and verification mechanisms involve generating time-bound consent-based links or QR codes, allowing requestors to access documents without physical submission, while real-time logging tracks all activities for auditability.[21] Verification relies on cryptographic checks against issuer repositories, confirming authenticity without altering originals, thus minimizing fraud risks in processes like KYC or compliance checks.[23] This federated model supports interoperability across government systems, with documents formatted in PDF or XML for compatibility.[25]Integration with Government Systems
DigiLocker facilitates integration with government systems through its API framework, enabling issuers—such as central and state government departments—to digitally push authentic documents into users' lockers and requesters to pull verified documents for services like approvals and verifications. Issuers register on the DigiLocker Partner Portal, configure APIs for document issuance, and implement REST-based pull URIs that allow the platform to query repositories using identifiers like Aadhaar numbers or issuer-specific details. This process ensures tamper-proof e-documents, such as certificates and licenses, are directly accessible without physical submission.[26] Central to these integrations is API Setu, a secure data exchange layer developed under the Ministry of Electronics and Information Technology (MeitY), which standardizes communication between DigiLocker and service providers across ministries and departments. It supports encrypted, consent-based sharing, reducing paperwork in processes like KYC and compliance checks. By August 2025, the National e-Governance Division (NeGD) had integrated nearly 2,000 e-government services pan-India via DigiLocker, spanning central ministries, state governments, and local bodies.[27][28] Key examples include the Income Tax Department, which issues PAN cards and Form 26AS directly into lockers for tax filings; the Central Board of Secondary Education (CBSE) under the Ministry of Education, enabling pull of mark sheets via roll numbers; and the Ministry of Road Transport and Highways through the National Register (VAHAN/SARATHI databases), allowing access to driving licenses and vehicle registrations across states. State-level integrations, such as Punjab Labour Department's services added in 2025, further extend coverage to employment certificates and welfare schemes.[24][29][30] These connections promote interoperability with broader ecosystems like UMANG app and e-District platforms, where users consent to share documents for seamless service delivery, though adoption varies by department due to API implementation requirements.[5]Features and User Services
Registration and Document Management
Users register for DigiLocker by visiting the official website at https://www.digilocker.gov.in/ and entering personal details, including full name, gender, mobile number, a 6-digit security PIN for login, and email ID, with Aadhaar number optional but recommended for accessing authentic government-issued documents.[31] The provided mobile number is authenticated via a one-time password (OTP) sent to it, ensuring secure account creation without requiring physical verification.[24] Upon successful submission, users are directed to their personalized dashboard, where they can optionally download the mobile app for Android or iOS to manage the account on the go.[31] Linking an Aadhaar number during or after registration enables enhanced functionality, such as automatic population of the user's name and date of birth from the Aadhaar database and seamless access to e-documents issued by government entities.[24] Accounts created solely with a mobile number limit users to uploading and managing self-attested documents, without the ability to pull verified official records directly from issuers.[31] This Aadhaar integration, governed by consent-based protocols, supports the platform's goal of providing legally valid digital equivalents of physical documents under the Information Technology Act.[1] Document management in DigiLocker centers on a cloud-based repository where users can fetch, upload, organize, and share files securely.[1] Authentic documents from over 100 integrated issuers, such as driving licenses, birth certificates, and educational qualifications, are automatically retrieved and stored as URI-linked references rather than file copies, ensuring real-time validity without manual intervention.[32] For non-issued documents, users navigate to the "Upload Documents" section on the dashboard or app, select files (typically PDFs or images under file size limits), tag them by category (e.g., personal ID, property papers), and upload for self-attestation.[33] Uploaded files are stored in the user's dedicated space, with options to edit metadata, generate shareable links for requesters like government agencies or employers, and track access logs for accountability.[27] The platform enforces organizational features like folder-based categorization and search functionality to facilitate efficient retrieval, while sharing mechanisms use time-bound, consent-driven links to minimize risks of unauthorized dissemination.[1] As of recent data, DigiLocker supports storage for millions of users, with uploaded documents treated as self-certified unless verified through integrated systems, promoting paperless transactions but requiring users to maintain originals for legal purposes where electronic equivalents are not admissible.[34]Verification and Sharing Mechanisms
DigiLocker's verification mechanisms rely on digital signatures embedded by issuing authorities, enabling real-time authentication by validating the signature against the issuer's public key infrastructure (PKI). This process confirms the document's origin, integrity, and non-repudiation, as the signatures are generated using asymmetric cryptography standards compliant with the Indian government's e-governance framework.[32][35] Users can scan QR codes on documents to access the official verification portal, which cross-checks the embedded metadata against the issuer's database for authenticity.[36] For user-uploaded documents, verification is augmented through eSign functionality, where individuals apply a legally binding electronic signature via Aadhaar-linked one-time password (OTP) authentication. This eSign service, integrated since 2015, leverages the Aadhaar ecosystem for identity proofing and is recognized under Section 3A of the Information Technology Act, 2000, as equivalent to a physical signature for government and certain private transactions.[37][24] To eSign, users upload a document, enter their Aadhaar number, receive an OTP on their registered mobile, and apply the signature, which includes a timestamp and certificate from the eSign service provider.[37] Document sharing in DigiLocker operates on a consent-based model, where users explicitly authorize access or transmission to recipients, minimizing unauthorized dissemination risks. Users select a document from their locker, generate a shareable PDF with embedded QR code or secure link, and distribute it via email, messaging apps, or direct download options provided in the platform interface.[38][39] For institutional sharing, such as with employers or agencies, the system employs API integrations via the API Setu platform, following OAuth 2.0 Authorization Code Grant flow with OpenID Connect for secure, time-bound consent; requesters receive pull-based access only after user approval, ensuring traceability and revocation capabilities.[34][40] This mechanism supports over 5,000 issuers and millions of annual shares as of 2023, reducing physical document handling while maintaining audit trails for each transaction.[27]Legal and Regulatory Framework
Amendments to Information Technology Act
In February 2017, the Ministry of Electronics and Information Technology notified an amendment to the Information Technology (Preservation and Retention of Information by Intermediaries Providing Digital Locker Facilities) Rules, 2016, inserting Rule 9A to confer legal equivalence on documents issued or shared via DigiLocker.[41] This rule stipulates that issuers may issue digitally signed certificates or documents directly into subscribers' Digital Locker accounts, and requesters—such as government agencies or private entities—must accept such shared documents at par with original physical versions, provided they comply with electronic signature provisions under the Information Technology Act, 2000.[42] The amendment, published as Gazette Notification G.S.R. 711(E) on February 8, 2017, was framed under Section 87 of the Information Technology Act, 2000, which empowers the central government to make rules for intermediaries handling digital records.[43] Rule 9A explicitly mandates: "(1) Issuers may start issuing and Requesters may start accepting digitally (or electronically) signed certificates or documents shared from subscribers’ Digital Locker Account at par with original or physical documents"; it further requires such documents to adhere to the Act's authentication standards, including digital signatures certified by the Controller of Certifying Authorities.[44] This regulatory change addressed prior limitations in treating digital replicas as legally binding, enabling DigiLocker to function as a verifiable repository without requiring physical originals for transactions like admissions, licenses, or compliance verifications.[7] Prior to the amendment, while the Information Technology Act, 2000 (as amended in 2008) recognized electronic records under Sections 4 and 5, the absence of specific equivalence for locker-shared documents limited adoption; Rule 9A bridged this by imposing preservation obligations on intermediaries while affirming parity, thus reducing fraud risks through URI-based sharing and e-signatures.[34] No further amendments to the core Act or these rules have altered DigiLocker's foundational legal status as of October 2025, though ongoing notifications under the Act have expanded integrations, such as with Aadhaar for authentication.[45] The provision has been upheld in government circulars, mandating acceptance across departments to streamline services.[46]Government Notifications and Compliance Requirements
The Information Technology (Preservation and Retention of Information by Intermediaries Providing Digital Locker Facilities) Rules, 2016, notified on February 8, 2017 via G.S.R. 711(E), establish core compliance obligations for digital locker intermediaries under the Information Technology Act, 2000. These rules mandate intermediaries to preserve user registration details, document metadata, and access logs for a minimum of 180 days from creation or last access, whichever is later, while enabling retrieval upon lawful request by authorities. Intermediaries must also maintain records of digital signatures and timestamps to ensure document authenticity and non-repudiation, with non-compliance attracting penalties under Section 72 of the IT Act.[47][48] Issuers of documents, such as government departments, are required to register on the Digital Locker Directory maintained by the Central government, issue digital records in standardized XML or PDF/A formats with embedded digital signatures, and provide persistent Uniform Resource Identifiers (URIs) for verification. Requesters, including employers or agencies, must accept digitally signed documents from DigiLocker as equivalent to originals if they bear valid electronic signatures under the IT Act. Failure to adhere to these protocols voids the legal equivalence of documents, as stipulated in the rules.[41][45] Sector-specific notifications reinforce compliance by directing acceptance of DigiLocker documents. The Ministry of Road Transport and Highways notified acceptance of digital driving licenses and vehicle registration certificates via DigiLocker as legally valid proofs, effective from 2018, to streamline enforcement and reduce physical document dependency. Similarly, the Telecom Regulatory Authority of India (TRAI) and Insurance Regulatory and Development Authority (IRDA) issued directives in 2017-2018 for using DigiLocker-issued policies and KYC documents in transactions. The Department of Administrative Reforms and Public Grievances (DARPG) mandated digital document issuance through DigiLocker for select services in 2018, promoting paperless governance. State-level notifications, such as Karnataka's February 2018 transport department order, extend these requirements to regional compliance.[24][49] Broader compliance encompasses data protection under the IT Act and emerging frameworks like the Digital Personal Data Protection Act, 2023, requiring consent-based sharing, breach notifications within 72 hours, and audit trails for access. Intermediaries must implement role-based access controls and anonymized logging for transparency, with annual compliance reporting to the Ministry of Electronics and Information Technology (MeitY). These measures ensure interoperability while mitigating risks of unauthorized access or tampering.[45][50]Security and Privacy Measures
Encryption, PKI, and Access Controls
DigiLocker secures documents through digital signatures applied using Digital Signature Certificates (DSCs), which verify authenticity and prevent tampering during storage and sharing.[51] These signatures leverage asymmetric cryptography, where issuers apply private keys to sign documents, allowing recipients to validate integrity via corresponding public keys.[51] The platform's Public Key Infrastructure (PKI) underpins DSC issuance and management, enabling trusted verification of document origins from government issuers.[51] [34] PKI components include certificate authorities for generating key pairs and revocation lists to invalidate compromised certificates, ensuring non-repudiation in electronic exchanges.[34] Recent enhancements incorporate advanced PKI for robust authentication and data integrity, as outlined in the platform's development roadmap.[52] Transmission of data employs 2048-bit RSA SSL encryption to protect against interception, complementing symmetric encryption for session keys in transit.[53] Storage maintains encryption at rest via issuer-applied signatures, with no explicit disclosure of additional symmetric ciphers in official documentation.[51] Access controls enforce multi-factor authentication (MFA), requiring mobile OTP or biometric verification alongside Aadhaar-linked credentials for login and operations.[51] [53] Document sharing mandates explicit user consent, with registered organizations obtaining time-bound permissions; unauthorized access triggers denial and audit logging.[51] Timed session logouts and consent revocation further mitigate risks from session hijacking.[53] Security is audited periodically by CERT-In empaneled agencies to validate these controls.[51]Compliance Standards and Data Protection Protocols
DigiLocker maintains compliance with the ISO 27001:2022 standard for information security management systems, which encompasses risk assessment, security controls, and continuous improvement processes to safeguard user data across its ecosystem.[51] This certification applies to the platform's operations, including data centers hosted on ISO 27001-compliant infrastructure, ensuring systematic handling of information security risks.[54] Issuers and integrators must also adhere to these standards, with mandatory security audits and protocols to prevent unauthorized access or breaches.[54] The platform aligns with India's Information Technology Act, 2000, particularly sections recognizing electronic records and digital signatures as legally equivalent to physical documents when issued through authenticated channels.[32] This framework underpins DigiLocker's data protection protocols, mandating secure storage, transmission, and sharing of documents while imposing liabilities for non-compliance.[45] Terms of service explicitly require adherence to prevailing Indian laws on data retention, privacy, and protection, including restrictions on data usage beyond consented purposes and obligations for breach notifications.[45] For digital locker service providers, certification rules enforce additional standards such as ISO 20000 for IT service management, ISO 27034 for application security, and accessibility guidelines under ISO 40500 (aligned with Guidelines for Indian Government Websites).[55] These protocols include regular vulnerability assessments, incident response plans, and compliance with CERT-In directives for cybersecurity reporting.[40] User consent mechanisms further operationalize data protection, requiring explicit approval for sharing or fetching documents, with retention limited to legally permissible durations.Adoption, Impact, and Effectiveness
User Growth and Statistical Overview
DigiLocker, launched on February 10, 2015, by the Ministry of Electronics and Information Technology (MeitY), initially saw modest adoption, with only 9.98 lakh new user sign-ups in 2015.[4] By December 2024, the platform had surpassed 37.046 crore registered users, reflecting accelerated growth driven by integrations with Aadhaar and government services.[56] This expansion continued into 2025, with 20.32 crore new sign-ups in 2024 alone, contributing to a total of 53.92 crore users by June 2025.[4] As of October 2025, DigiLocker reports over 55 crore registered users, alongside more than 800 crore issued digital documents, underscoring its role in India's digital infrastructure.[1] Cumulative document issuance has grown substantially, from 776 crore by December 2024 to the current figure, with users accessing certificates from over 1,700 issuers including central and state governments.[56][1] Adoption varies regionally, with Delhi and Haryana showing the highest penetration rates at approximately 29% of their populations linked via Aadhaar as of mid-2024, compared to a national average of 14%.[57]| Metric | Value (as of October 2025) | Source Citation |
|---|---|---|
| Registered Users | 55+ crore | [1] |
| Issued Documents | 800+ crore | [1] |
| Website Visits (since Oct 2024) | 160+ million | [58] |