Section 17(1)(d) in The Aadhaar (Authentication) Regulations, 2016
(d)identity information received during authentication is only used for the purpose specified to the Aadhaar number holder at the time of authentication, and shall not be disclosed further, except with the prior consent of the Aadhaar number holder to whom such information relates;