The Global Centre for Risk and Innovation (GCRI)
Digital identity systems let people prove who they are to access services, open accounts, receive benefits and vote. Hundreds of millions of people still lack official identification, while identity systems that collect too much data or exclude people can cause harm. This page sets out how identity and authentication systems work, how coverage and assurance are measured, and what evidence serves the governments and regulators who build and oversee them.
GCRI · In development · service level R0
Digital identity is the set of attributes and credentials that let people prove who they are online to access services, accounts and benefits. Foundational identity enables others, gaps fall on marginalised people, centralised data raise risk and authentication strength must match the risk of each use.
Night-time lights and population density, the footprint of electrified, connected activity, framed on India; each layer is a dated NASA product.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 2
Connected activity
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
Night-time lights and population density, the footprint of electrified, connected activity, framed on India.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
Identity infrastructure, exclusion and consent. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
A foundational identity, such as a national ID or civil registration, underpins functional credentials for health, voting, banking and benefits.
People without identity documents are disproportionately poor, rural, women, stateless or displaced. Requiring ID for services can exclude them further.
Large identity databases are attractive targets and can enable surveillance. Data minimisation, purpose limits and oversight reduce risk.
Authentication strength should match the risk of the transaction. Too weak invites fraud; too strong excludes people with limited devices or skills.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Foundational identity | A general-purpose legal identity, such as a civil register or national ID, used across services. |
| Functional identity | An identity credential issued for a specific purpose, such as voting or health insurance. |
| Authentication | The process of verifying that a person is the holder of a claimed identity. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Population with a foundational ID | percent of population | per survey | ID4D global dataset and surveys | ESTIMATED |
| Birth registration completeness | percent of births registered | annual | Civil registration statistics | ESTIMATED |
| Authentication failure rate | percent of attempts | monthly | System operator records | OBSERVED |
| Identity data breaches | count | annual | Regulator and incident reports | REPORTED |
| Identity systems with independent oversight | status | per assessment | Legal and institutional review | DECLARED |
| People unable to access services due to ID requirements | percent of surveyed population | per survey | Household surveys | REPORTED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| World Bank ID4D global dataset and diagnostics | Identification coverage and system assessments | Public, World Bank terms |
| UNICEF birth registration data | Birth registration by country | Public, UNICEF terms |
| NIST Digital Identity Guidelines (SP 800-63) | Identity proofing and authentication assurance levels | Public domain, US government |
| Data protection authority reports | Breaches and enforcement concerning identity data | Public records, licence per authority |
| Civil society assessments of identity systems | Rights and inclusion analyses | Public, terms per publisher |
Digital Public Infrastructure prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Ministries responsible for identity and civil registration | How to close coverage gaps and design safeguards | Coverage profiles; safeguard assessments |
| Service providers and regulators | What identity assurance to require for each service | Assurance reviews |
| Data protection authorities | How to oversee identity data | Breach and oversight evidence |
Proof of identity is a gateway to almost everything else: health care, education, social protection, financial services, property and voting. Many people worldwide still lack recognized proof of identity, often the poorest and most marginalized. Digital identity can close that gap, but systems that are hard to enrol in, rely on a single biometric or concentrate personal data can create new forms of exclusion and new risks to privacy.
Identity systems combine registration, credentials, authentication and governance.
Civil registration of births and deaths and population registers provide the base. Gaps in registration carry through into digital identity.
Passwords, cards, mobile credentials and biometrics each fail in different ways. Biometric matching works less well for some people, such as manual labourers and older people.
Legal basis, purpose limitation, independent oversight and redress decide whether identity serves people or monitors them.
A central lesson from national experience is that identity systems should not become mandatory gateways before they reach everyone. Where services require digital authentication before enrolment is universal and alternatives exist, the people most in need are often the ones turned away. Safeguards such as assisted channels, exception handling and clear routes to redress are part of the infrastructure, not additions to it.
Registration and enrolment statistics show reach but often miss the people least likely to be counted.
Error rates by method and population group. They are not always published, and averages can hide large differences.
Analysis of legal frameworks, data protection and oversight. Law on paper may differ from practice.
Studies of how people experience enrolment and authentication, complementing technical work under digital identity and public digital systems.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.