Census 2027: Another fraudulent register of citizens in the making?

Census 2027 asks 148 crore people to trust the State with their information. That trust gets shaky when the government is collecting unprecedented amounts of personal data through a proprietary platform that has a history of being hacked in a cyber espionage case.

Traditionally, a Census gathers demographic and housing information to frame public policy. Census 2027 goes further, seeking personal identifiers that raise serious questions about privacy, surveillance and the State’s interest in citizens’ data.

A notification of 14 August, under Section 8(1) of the Census Act, 1948, lists 40 subjects for the Household Schedule, against 29 questions in 2011. Most of these — questions of age, religion, language, education, occupation, migration, for instance — are conventional, but Census 2027 will gather additional details that mark an alarming departure from the old demographic enumeration.

Items 35 to 40 seek the number of bank accounts, mobile number, Aadhaar number, EPIC (Voter ID) number and passport number and driving licence number for those who have it. As Down To Earth pointed out, no Indian Census between 1872 and 2011 sought document numbers. Item 34 even asks where the person received the COVID-19 vaccine. Why?

These personal identifiers could link Census records directly to government and commercial databases, including Aadhaar, voter rolls, passport records, mobile connections and banking systems. The result could be a detailed personal profile rather than an anonymous demographic snapshot.

Economist Dipa Sinha says this goes against the very logic of the Census: “The idea of a Census is to count, not identify.”

The question, then, is: what statistical purpose does recording these document numbers, which link them to individuals, serve? Both the Census Act, 1948, and the United Nations’ fundamental principles for censuses stress that individual population data must stay confidential. Section 15 of the Act protects census records from inspection and makes them inadmissible as evidence. If the data is meant to be anonymous, what purpose does the collection of these numbers serve?

The Household Schedule also seeks the names of parents, their religion and place of birth, down to the village level. Married persons are asked about their spouses. Digital rights groups argue that such intergenerational information goes beyond counting the present population, allowing the State to build family profiles and track individuals across generations.

The issue is not merely whether the government is legally entitled to ask for such information. It is whether citizens understand how the information that is being collected will be used, who will have access, how long it will be retained and whether it can later be linked to another government database.

Against the background of earlier debates over citizenship and the NPR-NRC framework, the drive to gather granular personal information and the absence of clearly articulated boundaries on the use of this data is a big concern.

It is not even an option to withhold information, since participation is compulsory. When citizens must disclose personal, financial and ancestral information under threat of penal action, consent becomes notional. The Internet Freedom Foundation (IFF) argues that the compulsion to disclose information places a heightened obligation on the State to minimise the nodes of data it seeks.

In effect, the ongoing exercise appears designed to de-anonymise Census data. K. Narayanan Unni, former deputy registrar-general of India, says: “It appears the government is planning to use the data collected to update the National Population Register prepared in 2011, or prepare it afresh.”

****

The concerns around the collection of personal data acquire a bleeding edge with the government’s decision to procure ArcGIS, a geographical information system from US company Esri, for mapping, creating enumeration blocks and processing demographic data. The registrar general’s office has bought 96 licences for Rs 14.39 crore.

Researchers at US cyber security firm ReliaQuest documented a case in which a Chinese state-linked group, assessed with moderate confidence to be Flax Typhoon, compromised an ArcGIS server belonging to an unnamed organisation and kept covert access for over a year. Esri blames an exposed management interface without multifactor authentication and an overprivileged account — a compromised deployment, not necessarily compromised software. That distinction offers little reassurance.

Cyberlaw expert Pawan Duggal is blunt: “Using such software is against the sovereignty of the country.” He argues that due diligence and a proper audit are essential before such applications are deployed, and if India cannot avoid foreign software, it must insist on access to the complete source code.

Then there is the US CLOUD [Clarifying Lawful Overseas Use of Data] Act, which requires US-based providers to disclose data in their control to American authorities, even when stored overseas, subject to legal processes.

Apar Gupta of IFF underlines the stakes: “The software is recording the geospatial details of every resident of India. Imagine if this data is in the control of somebody other than the government of India. What does it mean?”

The procurement itself raises questions. According to IFF, which investigated the purchase, the licences were acquired through a ‘proprietary article certificate’, which permits buying without competitive tender when a product is deemed necessary. The contract, awarded on 10 June 2026, went to Corporate Infotech Private Limited for Rs 14,38,74,322. All four bidders offered the same Esri India product.

IFF says the government relied on a 2019 file to continue with the same platform and asks whether any fresh technical assessment preceded the 2026 purchase. India already has ISRO’s Bhuvan, and open-source GIS offers other options. The government must disclose whether alternatives were evaluated and why they were rejected. Also, buying through an Indian reseller does not establish tech sovereignty.

IFF’s RTI applications and letters to the registrar general and Esri India had not been answered when its report was published.

A Census is strictly mandated to maintain the anonymity of citizen data. This exercise, earlier conducted on paper and reliant on people, is now being done digitally, featuring interconnected software, devices and networks, each a potential point of vulnerability. Independent security audits and clear accountability is the least the government owes 148 crore Indians who must participate in the exercise and have no legal protection if they don’t wish to disclose personal information.