For almost four years, Digi Yatra has let domestic passengers walk through an airport on the strength of their face. On 1 November 2026, the Ministry of Civil Aviation announced that the same idea is now being tried on international flights. Trials have begun at seven airports, will run through November and December 2026, and are meant to collect passenger feedback before a wider rollout in 2027.
The announcement is short, but it touches four things that appear together in competitive exams: a government technology platform, a non-profit company that runs it, a biometric (the face) whose use raises a privacy question, and a new data-protection law that is still being phased in. This article takes them in that order.
What the trials allow, and what they do not
| Feature | Detail (PIB, 1 November 2026) |
|---|---|
| Period | November to December 2026 |
| Airports | Delhi, Bengaluru, Hyderabad, Cochin, Mumbai, Chennai and Amritsar |
| Airlines | Air India and IndiGo, on select international flights |
| Who can use it | Eligible Indian nationals holding e-passports |
| Where | Terminal entry points, Security Hold Areas (SHA) and boarding gates, wherever the infrastructure exists |
| What happens next | Feedback shapes a wider rollout in 2027 |
Three limits matter. First, the facility is meant to complement, not replace, existing processes: passengers must still carry their travel documents and clear airline document checks, immigration and every other formality. Digi Yatra speeds up the walk to the aircraft; it does not stamp the passport. Second, not every touchpoint at every airport is equipped yet. Third, only holders of the new chip-based passport can take part.
The domestic platform gives the trials their scale. Digi Yatra now has over 26.5 million users and has enabled more than 110 million journeys across 39 domestic airports, and 25 more domestic airports are planned by 2027. That works out to about four journeys per registered user, which suggests that those who sign up tend to keep using it.
Building the credential: from e-passport to phone wallet
To use the facility, an eligible traveller creates an e-passport-based Verifiable Credential (VC) in the Digi Yatra app. The release lists four steps. Each one proves something different.
- Scan the MRZ. The Machine Readable Zone is the two lines of coded text at the bottom of the photo page. Its contents (document number, date of birth, expiry date) act as the key that lets a reader open the chip, under the international standards for e-passports set by the International Civil Aviation Organization (ICAO).
- Read the chip by NFC. Near Field Communication is the short-range radio used for tap-to-pay. The chip holds the holder's details and photograph, digitally signed by the issuing authority, so the phone can check that nothing has been altered.
- Capture a selfie. The live face is compared with the photograph from the chip. This proves that the person holding the phone is the person the passport describes.
- Verify and store. The details are checked and the credential is saved in the Digi Yatra wallet on the phone.
India's chip-based e-passport is what makes this possible. It has been rolling out under the Passport Seva Programme Version 2.0, after a pilot in April 2024, and carries a government-signed digital copy of the holder's identity and photograph. Existing passports stay valid until they expire, so the pool of eligible travellers is limited by how many people have already switched. For domestic flights, registration relies instead on Aadhaar-based identity checks, which our explainer on Aadhaar, UIDAI and digital identity covers.
Where the face data lives: the decentralised design
Digi Yatra follows what the Ministry describes as a Self-Sovereign Identity (SSI) model. Personal details and travel credentials are stored on the passenger's own device, not in a central repository. The Foundation's technical layer, the DigiYatra Central Ecosystem, is used to issue and check Verifiable Credentials.
A Verifiable Credential involves three parties:
- The issuer vouches for a fact and signs it. For the e-passport credential, the signature on the chip comes from the passport-issuing authority.
- The holder keeps the credential in a wallet. Here, that is the passenger's phone.
- The verifier checks the credential when asked. Here, that is the airport or airline at a touchpoint.
The verifier can check the issuer's signature without going back to the issuer. That is the whole point of decentralised storage: nobody needs to hold a master copy of everyone's face.
On retention, the position taken by the Government is that data shared with the departure airport is used only for the journey and purged within 24 hours of the flight's departure. The Civil Aviation Minister said so at the December 2022 launch. The Foundation's chief executive has also said it does not itself store passenger data. These are statements of design and policy. Privacy researchers pointed out at the launch that deletion is claimed but cannot easily be checked from outside, and the Internet Freedom Foundation has written to the Ministry asking it to stop the scheme. A good answer presents both: the architecture is privacy-friendly on paper, and independent verification is limited.
Who runs Digi Yatra
Digi Yatra is not a government department. Two layers exist:
- The policy. On 4 October 2018, the Ministry of Civil Aviation released the policy for biometric-based digital processing of passengers at airports, called Digi Yatra.
- The Foundation. The scheme is operated by the DigiYatra Foundation, a Section 8 (non-profit) company formed in 2019.
| Shareholder | Stake |
|---|---|
| Airports Authority of India (AAI) | 26% |
| Delhi International Airport (DIAL) | 14.8% |
| Bengaluru International Airport (BIAL) | 14.8% |
| GMR Hyderabad International Airport (GHIAL) | 14.8% |
| Mumbai International Airport (MIAL) | 14.8% |
| Cochin International Airport (CIAL) | 14.8% |
The stakes add up: 26% + 5 × 14.8% = 100%. AAI is the statutory body under the Ministry that manages many of India's airports, and the other five are the operators of large airports. The mix reflects how Indian airports are run: some by AAI directly, some by public-private joint ventures.
How it grew
| When | Milestone |
|---|---|
| 4 Oct 2018 | Digi Yatra policy released by the Ministry of Civil Aviation |
| 2019 | DigiYatra Foundation formed as a Section 8 company |
| 1 Dec 2022 | Launched at Delhi, Bengaluru and Varanasi (facial recognition at entry, security and boarding) |
| Mar–Apr 2023 | Added at Hyderabad, Kolkata, Pune and Vijayawada |
| Jun 2023 | One million app registrations reported |
| 2026 | Over 26.5 million users and 110 million journeys across 39 airports (PIB) |
| 1 Nov 2026 | International trials begin at seven airports |
| 2027 | 25 more domestic airports planned; wider rollout of the international facility |
A rule of thumb for an exam: Digi Yatra is a Ministry of Civil Aviation initiative, run by a Foundation in which AAI holds 26%, and its first phase went live on 1 December 2022. For the wider aviation story, see our note on Viksit UDAN and regional air connectivity.
The data-protection test
A face cannot be changed like a password, which is why biometrics attract more scrutiny than other data. The constitutional anchor is K.S. Puttaswamy v. Union of India (2017), in which a nine-judge bench held that the right to privacy is a fundamental right under Article 21. Our page on fundamental rights: liberty covers the Article. The statute is the Digital Personal Data Protection (DPDP) Act, 2023, which received the President's assent on 11 August 2023.
| DPDP idea | What the law says | The Digi Yatra question |
|---|---|---|
| Data Principal | The individual whose data is processed | The passenger |
| Data Fiduciary | Whoever alone or with others decides the purpose and means of processing | Is it the Foundation, the airport operator or the airline? The design spreads the roles |
| Consent | Free, specific, informed, unconditional and unambiguous, given by a clear affirmative action | Was the passenger told what the camera was for? |
| Security safeguards | A fiduciary must take reasonable safeguards; a failure that leads to a breach can draw a penalty of up to ₹250 crore | Security of the wallet, the app and the matching systems |
| Data Protection Board of India | Hears complaints and imposes penalties | The route for a passenger who objects |
The law is being brought in stages. The DPDP Rules, 2025 were notified on 13 November 2025. The provisions that set up the Data Protection Board took effect immediately. Registration of consent managers begins one year later, on 13 November 2026, and the main duties (notice, security safeguards, breach reporting, erasure and the rights of data principals) apply from 13 May 2027. The trials run in the months before that date, and a 2027 rollout may fall partly or wholly under the full regime. That is a reading of the two timelines, not a statement in the release.
The concerns raised so far are practical rather than theoretical. In a January 2024 online survey of Delhi-airport fliers reported in the media, about 29% of respondents said they had been enrolled at the gate without their knowledge. In December 2024, the Government publicly denied reports that Digi Yatra data would be used to catch tax evaders. Neither episode shows a breach, but both show how quickly trust is tested when a biometric is involved.
What the international trials change
- A new kind of credential. The domestic flow rests on Aadhaar-based registration; the international trial rests on the e-passport, so the identity proof comes from the passport itself.
- More touchpoints. Terminal entry, Security Hold Areas and boarding gates can all use the credential, where the equipment exists.
- Airline participation. Two carriers, Air India and IndiGo, are involved, so the trial tests how airline systems and airport systems share a credential.
- A defined learning phase. The two-month window is meant to produce feedback on how passengers, airlines and airports actually use it, ahead of 2027.
What they do not change is the legal border. Immigration officers still check documents, as before.
🔑 Revision block
The news. 1 November 2026: Digi Yatra trials for international passengers at 7 airports (Delhi, Bengaluru, Hyderabad, Cochin, Mumbai, Chennai, Amritsar); November to December 2026; Air India and IndiGo; wider rollout in 2027.
Who and how. Eligible Indian nationals with e-passports build a Verifiable Credential: scan MRZ, read chip by NFC, take selfie, store in the phone's Digi Yatra wallet. Used at terminal entry, SHA and boarding gates. Does not replace immigration or airline checks.
Scale. 26.5 million users, 110 million journeys, 39 domestic airports; 25 more by 2027.
Who runs it. Policy: MoCA, 4 October 2018. Operator: DigiYatra Foundation, a Section 8 company (2019): AAI 26% and DIAL, BIAL, GHIAL, MIAL, CIAL at 14.8% each. First launch: 1 December 2022 (Delhi, Bengaluru, Varanasi).
Design. Self-Sovereign Identity: credentials stay on the passenger's phone; data at the airport is stated to be purged within 24 hours of departure.
Law. Puttaswamy (2017): privacy is part of Article 21. DPDP Act 2023 (assent 11 Aug 2023); Rules notified 13 Nov 2025; consent managers from 13 Nov 2026; main duties from 13 May 2027; penalty up to ₹250 crore for failing to safeguard data.
🎯 Practice MCQs
Q1. Who is eligible to use Digi Yatra in the international trials that began in November 2026?
(a) Any foreign national travelling from India
(b) All Indian passport holders
(c) Eligible Indian nationals holding e-passports
(d) Only frequent flyers of Air India
→ (c)
The credential is built from the chip in an e-passport. Holders of older passports cannot create it, and foreign nationals are outside the trial.
Q2. In creating an e-passport-based credential on the Digi Yatra app, the phone reads the passport chip using:
(a) Near Field Communication (NFC)
(b) Bluetooth Low Energy
(c) The Global Positioning System
(d) Infrared signals
→ (a)
NFC is the short-range radio used for tap-to-pay. The MRZ is scanned first, and it supplies the key that allows the chip to be read.
Q3. In the DigiYatra Foundation, the shareholding of the Airports Authority of India is:
(a) 14.8%
(b) 26%
(c) 51%
(d) 74%
→ (b)
AAI holds 26%, and each of the five airport operators (Delhi, Bengaluru, Hyderabad, Mumbai, Cochin) holds 14.8%. The total is 100%.
Q4. Consider the following statements about the Digi Yatra international trials:
1. The facility replaces the immigration and airline document checks.
2. The DigiYatra Foundation is a department of the Ministry of Civil Aviation.
Which of the statements given above is/are correct?
(a) 1 only
(b) 2 only
(c) Both 1 and 2
(d) Neither 1 nor 2
→ (d)
The release says the facility complements and does not replace existing processes. The Foundation is a Section 8 non-profit company owned by AAI and five airport operators, not a department.
Q5. Under the Digital Personal Data Protection Act, 2023, the individual to whom the personal data relates is called:
(a) Data Principal
(b) Data Fiduciary
(c) Data Processor
(d) Data Controller
→ (a)
The person who decides the purpose and means of processing is the Data Fiduciary. "Data Controller" is the term used in the European GDPR, not in this Act.
Q6. The DPDP Act, 2023 provides for the establishment of the:
(a) Data Protection Authority of India
(b) National Cyber Security Coordinator
(c) Data Protection Board of India
(d) Central Information Commission as its adjudicator
→ (c)
The Board hears complaints and imposes penalties. "Data Protection Authority" was the body proposed in earlier drafts of the Bill.
Q7. Which of the following is NOT among the seven airports at which the Digi Yatra international trials have begun?
(a) Cochin
(b) Amritsar
(c) Chennai
(d) Kolkata
→ (d)
The seven are Delhi, Bengaluru, Hyderabad, Cochin, Mumbai, Chennai and Amritsar. Kolkata was among the airports added to the domestic platform in 2023.
Q8. Digi Yatra was first launched, on 1 December 2022, at:
(a) Mumbai, Chennai and Pune
(b) Delhi, Bengaluru and Varanasi
(c) Delhi, Mumbai and Kolkata
(d) Hyderabad, Kolkata and Vijayawada
→ (b)
Hyderabad, Kolkata, Pune and Vijayawada followed in the next phase in early 2023.
📋 How this gets asked (PYQ pattern)
Science and technology questions on digital public infrastructure come in a few steady forms. The first is matching an initiative to its ministry or implementer: Digi Yatra to Civil Aviation, a Foundation and AAI; Aadhaar to UIDAI; DigiLocker to MeitY. The second is what the technology does: facial recognition versus fingerprint, what NFC is, what "decentralised storage" means. The third is law and rights: Article 21 and privacy, the DPDP Act's vocabulary (Data Principal, Data Fiduciary, Board) and the headline penalty.
The traps are predictable. "Foundation" tempts candidates to call it a government body when it is a Section 8 company. "Trial" is read as "launch". And the DPDP Act's terms are confused with the European GDPR's. The fresh hooks this cycle are the seven airports, the e-passport credential, the 26.5 million / 110 million / 39 platform figures and the 13 May 2027 date for the Act's main duties.
Preparing for CDS? When you read a technology story, ask three questions: who runs it, where does the data live, and which law governs it. Those three answer most questions on digital public infrastructure. Follow the daily CDS current affairs, revise with the CDS/OTA study material, and learn with experienced faculty in the upcoming Cavalier courses in Delhi.
Source: PIB / Ministry of Civil Aviation, "Digi Yatra Begins International Passenger Trials at Seven Airports", 1 November 2026. Background on the Digi Yatra policy, the Foundation's shareholding and its Self-Sovereign Identity design from the Ministry of Civil Aviation release of 4 October 2018, the Foundation's published privacy policy and parliamentary replies; DPDP Rules 2025 timeline from the Gazette notification of 13 November 2025.
✍️ Written by Aditya Tiwari — Science & current-affairs faculty at The Cavalier. Reviewed by the Cavalier Faculty Desk.