GCRI · Digital Public Infrastructure
Identity and authentication
Digital identity systems let people prove who they are to access services, open accounts, receive benefits and vote. Hundreds of millions of people still lack legal identification, while identity systems that collect too much data or exclude people can cause harm. This page sets out how identity and authentication systems work, how coverage and assurance are measured, and what evidence serves the governments and regulators who build and oversee them.
Identity and authentication on the record.
Identity and authentication: how the risk develops.
Identity infrastructure, exclusion and consent. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Foundational identity enables others
A foundational identity, such as a national ID or civil registration, underpins functional credentials for health, voting, banking and benefits.
Gaps fall on the marginalised
People without identity documents are disproportionately poor, rural, women, stateless or displaced. Requiring ID for services can exclude them further.
Centralised data raise risk
Large identity databases are attractive targets and can enable surveillance. Data minimisation, purpose limits and oversight reduce risk.
Assurance must fit the use
Authentication strength should match the risk of the transaction. Too weak invites fraud; too strong excludes people with limited devices or skills.
How identity and authentication is modelled, measured and tested.
The model, its assumptions, its data and its uncertainty, in the form a scientist or engineer would check. Structures follow published methods. The values drawn are illustrative, not findings.
Datasets and provenance
The data classes behind identity and authentication and what is recorded about each before it is used.
| Data class | Provenance recorded | Resolution stated | Licence checked |
|---|---|---|---|
| Satellite imagery, optical and radar | sensor, processing level, acquisition date | pixel size and revisit | per scene |
| Reanalysis and climate model output | model, experiment, member, version | grid and time step | per release |
| In-situ sensors and gauges | station, instrument, calibration record | point and sampling rate | per network |
| Population and asset exposure | method, vintage, input sources | cell size and unit | per release |
| Boundaries and reference geography | producer, edition, date | scale | per edition |
- Lineage
- W3C PROV record from source to figure
- Principles
- FAIR: findable, accessible, interoperable, reusable
- Gaps
- shown as missing, never filled silently
Identity systems unlock services across domains.
Findings are designed for the Strategic Systems series. The Principles on Identification (2017, revised 2021), the Universal DPI Safeguards Framework (2024) and eIDAS 2 (2024) frame practice; records would carry identifiers under NS-9 of the proposed Nexus Standards.
- Exclusion case studies.
- Safeguards assessments.
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Population with a foundational ID | percent of population | per survey | ID4D global dataset and surveys | ESTIMATED |
| Birth registration completeness | percent of births registered | annual | Civil registration statistics | ESTIMATED |
| Authentication failure rate | percent of attempts | monthly | System operator records | OBSERVED |
| Identity data breaches | count | annual | Regulator and incident reports | REPORTED |
| Identity systems with independent oversight | status | per assessment | Legal and institutional review | DECLARED |
| People unable to access services due to ID requirements | percent of surveyed population | per survey | Household surveys | REPORTED |
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| World Bank ID4D global dataset and diagnostics | Identification coverage and system assessments | Public, World Bank terms |
| UNICEF birth registration data | Birth registration by country | Public, UNICEF terms |
| NIST Digital Identity Guidelines (SP 800-63) | Identity proofing and authentication assurance levels | Public domain, US government |
| Data protection authority reports | Breaches and enforcement concerning identity data | Public records, licence per authority |
| Civil society assessments of identity systems | Rights and inclusion analyses | Public, terms per publisher |
Who decides, and what the evidence serves.
Digital Public Infrastructure prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Ministries responsible for identity and civil registration | How to close coverage gaps and design safeguards | Coverage profiles; safeguard assessments |
| Service providers and regulators | What identity assurance to require for each service | Assurance reviews |
| Data protection authorities | How to oversee identity data | Breach and oversight evidence |
Outputs this topic produces
- Identity coverage and exclusion profiles
- Assurance level reviews matched to service risk
- Safeguard assessments against the UN DPI Safeguards Framework
- Evidence notes for identity governance
What experts ask.
Proof of identity is a gateway to almost everything else: health care, education, social protection, financial services, property and voting. Many people worldwide still lack recognised proof of identity, often the poorest and most marginalised. Digital identity can close that gap, but systems that are hard to enrol in, rely on a single biometric or concentrate personal data can create new forms of exclusion and new risks to privacy.
- Who can enrol in an identity system, and who is left out because of documents, disability, location, gender or status?
- How reliable is authentication for different groups, and what happens when it fails?
- What personal data does the system collect, who can access it and under what legal safeguards?
- Can people use their identity with consent and selective disclosure, sharing only what a service needs?
Drivers and processes.
Identity systems combine registration, credentials, authentication and governance.
Foundational records
Civil registration of births and deaths and population registers provide the base. Gaps in registration carry through into digital identity.
Checking identity
Passwords, cards, mobile credentials and biometrics each fail in different ways. Biometric matching works less well for some people, such as manual labourers and older people.
Rights and oversight
Legal basis, purpose limitation, independent oversight and redress decide whether identity serves people or monitors them.
A central lesson from national experience is that identity systems should not become mandatory gateways before they reach everyone. Where services require digital authentication before enrolment is universal and alternatives exist, the people most in need are often the ones turned away. Safeguards such as assisted channels, exception handling and clear routes to redress are part of the infrastructure, not additions to it.
How the evidence is built, and its limits.
- 01
Coverage data
Registration and enrolment statistics show reach but often miss the people least likely to be counted.
- 02
Authentication failure analysis
Error rates by method and population group. They are not always published, and averages can hide large differences.
- 03
Legal and rights review
Analysis of legal frameworks, data protection and oversight. Law on paper may differ from practice.
- 04
User research
Studies of how people experience enrolment and authentication, complementing technical work under digital identity and public digital systems.
How it is studied, and what the methods cannot say.
- 01Digital identity and public digital systemsAssurance design for services · Verifiable credentials · Exclusion error analysisApplied here
- 02Cybersecurity and cryptographyThreat modelling DPI components · Protecting identity databasesApplied here
- 03Data engineering, interoperability and stewardshipSecure data exchange layers · Common data models · Consent-based sharingApplied here
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
- Principles on Identification for Sustainable Development (World Bank ID4D and endorsing organisations, 2017, revised 2021)
- Universal DPI Safeguards Framework (UN Office for Digital and Emerging Technologies and UNDP, 2024)
- Regulation (EU) 2024/1183 establishing the European Digital Identity Framework
- NS-9, Contextual UNIs for deployments and programme instances, a proposed standard
Where this page leads across the Consortium.
Questions and answers.
What is foundational identity?
What is an identity assurance level?
Why can digital ID exclude people?
Should identity systems use biometrics?
What is selective disclosure?
Is a national identity number a risk?
Does the platform hold identity data?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.