What makes digital public infrastructure good, not just big?

Analysis · Published 2026-10-01

Black and white photograph of the Manhattan Bridge under construction, with its towers and cables spanning the river above warehouses — The Manhattan Bridge under construction, New York, March 1909. Photo: Irving Underhill, public domain, via Wikimedia Commons.

In a few years, digital public infrastructure has moved from a niche term to a fixture of international declarations. The G20 adopted a framework for it in 2023; the UN's Global Digital Compact, agreed in September 2024, recognises its potential; and a campaign launched in November 2023 aims to help 50 countries deploy at least one DPI component by the end of 2028. The harder question is not whether to build DPI, but how to tell good DPI from systems that are simply big.

Why "big" is not enough

Coverage of DPI tends to lead with scale: the number of identities issued, the billions of monthly payments, the number of services connected. Scale matters, because shared infrastructure only pays off when many people and organisations use it. But scale is also what every large system, good or bad, can claim. A centralised identity database with weak legal safeguards can enrol a whole population; a payment network can process billions of transactions while concentrating the market in two apps. Size measures adoption, not quality.

A more useful approach is to ask what a piece of infrastructure does for the people who depend on it, and what it costs them when it fails. We propose five tests.

Test 1: Purpose — does it solve a problem people actually have?

Good DPI starts from a service problem: people cannot open a bank account without documents; small firms cannot get paid quickly; patients' records do not follow them between hospitals. Bad DPI starts from a technology or a political announcement and looks for uses later. A simple check: can the team name the first services that will run on the system, who will build them, and how success will be measured? Our design toolkit lists the questions in detail.

Test 2: Reach — who is left out, and what happens to them?

The World Bank's ID4D programme estimated that just under 850 million people worldwide lacked official proof of identity in 2021, most of them in lower-income countries in Africa and South Asia. Digital systems can reduce that gap, but they can also create new exclusions: when biometric authentication fails, when connectivity drops, when a digital credential becomes the only route to a food ration or a pension.

Good DPI measures and publishes its failures, keeps offline and assisted channels, and never makes a single credential the only gateway to an essential right. A system that reports only successful transactions is telling half the story.

Test 3: Rights — is privacy designed in, and is there redress?

Identity and data exchange layers touch the most sensitive information a state holds. Good DPI minimises data collection, federates data rather than pooling it, uses techniques that limit tracking across services, and gives people a view of who accessed their records. It rests on a law, with an independent authority and a way to challenge decisions.

The Universal DPI Safeguards Framework, released on 24 September 2024 by the UN Secretary-General's Envoy on Technology and UNDP after a multi-stakeholder process, is an attempt to turn these expectations into practical guidance. We examine it in DPI governance and safeguards, and the techniques in digital ID privacy safeguards.

Test 4: Markets — does it open competition or close it?

A core promise of DPI is that neutral public rails let many providers compete on services. That promise is real when interfaces are open, participation rules are published and the operator does not favour its own products. It fails when the rails are open in theory but onboarding is slow and arbitrary, or when a few private players capture the user relationship on top of public infrastructure.

India's experience shows both sides: UPI's open access for third-party apps drove rapid adoption, while the concentration of transactions in a few apps has prompted proposals for market-share caps that have been repeatedly postponed. See UPI and instant payments.

Test 5: Resilience — what happens when it breaks?

Infrastructure is defined by dependence. When roads close, people take another road; when a national identity or payment system goes down, there may be no other road. Good DPI is designed for failure: redundancy, tested continuity plans, graceful degradation (offline modes, manual fallbacks), rapid security response and the ability to replace components without starting over. Open standards and, where appropriate, open-source code help, because they reduce dependence on a single supplier. See open source versus proprietary software.

Applying the tests

Test	Good sign	Warning sign
Purpose	Named first services and builders; outcome targets.	Launch announced before use cases are defined.
Reach	Published exclusion and failure rates; assisted channels.	Only adoption statistics are published.
Rights	Law, independent oversight, access logs visible to users.	Operates on executive orders; no grievance route.
Markets	Open APIs, published onboarding rules, many active providers.	Operator's own app dominates; onboarding by negotiation.
Resilience	Fallbacks, open standards, modular components.	Single vendor; no offline mode.

Why the tests matter now

The 50-in-5 campaign was launched on 8 November 2023 with eleven "first mover" countries (Bangladesh, Estonia, Ethiopia, Guatemala, Moldova, Norway, Senegal, Sierra Leone, Singapore, Sri Lanka and Togo) and is led by a coalition including UNDP, the Digital Public Goods Alliance, the Centre for Digital Public Infrastructure, Co-Develop and the Bill & Melinda Gates Foundation. Many more countries are now designing systems, often with external funding and advice. That makes this a moment when choices on law, architecture and procurement will set the terms for decades.

The temptation will be to measure progress by launches and enrolment counts. The more useful measure is whether, five years on, people can rely on these systems, challenge them when they fail, and choose among the services built on top.