Who governs digital public infrastructure? Operators, oversight and the UN safeguards push

Analysis · Published 2026-10-14

An empty meeting room with a long wooden table, chairs and bookshelves under arched windows — A conference room in the abbey of Heiligengrabe, Brandenburg, Germany. Photo: Dietmar Rabich, CC BY-SA 4.0, via Wikimedia Commons.

The technical design of digital public infrastructure gets most of the attention. Its governance, who runs it, who sets the rules, who can stop misuse, gets far less, even though it is what determines whether people can trust it. This analysis looks at the main governance models and at the international effort, led by the UN, to agree on safeguards.

Five ways to run the rails

Countries have chosen very different institutional homes for their core systems. Each has trade-offs.

Model	Example	Strengths	Risks
Government agency	Singapore's GovTech, which runs Singpass	Clear mandate, coherent design, public accountability through ministers.	Operator and rule-setter are the same; oversight of the state's own data use can be weak.
Statutory authority	India's UIDAI, established under the Aadhaar Act 2016	Legal basis defines purposes and limits; parliamentary oversight.	Depends on the strength of the statute and of external audit.
Not-for-profit company	NPCI (UPI); GSTN (GST)	Operational flexibility, technical hiring, industry participation.	Ownership and control questions; accountability less direct than for public bodies.
Central bank	Banco Central do Brasil (Pix)	Strong regulatory power to require participation and set rules.	Concentration of operator and regulator roles.
Intergovernmental body	Nordic Institute for Interoperability Solutions (X-Road core)	Shared costs, no single-country capture of the code.	Slower decisions; national deployments still need national governance.

The GSTN case shows how governance can change under pressure: a company with a private majority stake was converted, from 2018, into a fully government-owned entity after criticism over control of taxpayer data.

Accountability mechanisms that matter

A specific legal basis that states purposes, limits and penalties, rather than reliance on executive orders.
Separation of roles between the operator, the rule-setter and the regulator where possible, or at least independent review where they coincide.
External audit. Supreme audit institutions, such as India's Comptroller and Auditor General, which has audited both the GST rollout and the Aadhaar authority, can examine performance and controls.
Independent data protection oversight with the power to investigate and sanction, including public bodies.
Judicial review. Courts in India, Jamaica and Kenya have shaped identity systems by requiring proportionality and prior impact assessment. See digital ID privacy safeguards.
Participation. Structured consultation of civil society, industry and local governments on rule changes, and published decisions.
Transparency. Regular statistics, including on failures and grievances, and publication of key documents such as impact assessments and participation rules.

The international safeguards effort

As DPI became a development priority, concern grew that systems could be exported and replicated faster than the safeguards around them. Three developments stand out.

The Universal DPI Safeguards Framework

In September 2023 the UN Secretary-General's Envoy on Technology and UNDP launched an initiative to develop a universal safeguards framework for DPI. Multi-stakeholder working groups were announced in March 2024, and the framework was released on 24 September 2024. It is presented as practical guidance for designing and implementing DPI that is safe, inclusive and rights-respecting, to be adapted to national contexts rather than imposed as a single standard. At the launch, Rwanda and the East African Community were highlighted as applying the safeguards in their DPI work. The framework is published on a dedicated site, dpi-safeguards.org.

The Global Digital Compact

The Global Digital Compact, adopted by UN member states in September 2024 as part of the Pact for the Future, recognises the role of DPI in inclusive digital transformation and the Sustainable Development Goals, and links it to commitments on human rights and safeguards. It gives the topic a place in the UN's formal agenda, though, like most such texts, it is not binding.

The 50-in-5 campaign

Launched on 8 November 2023 with eleven first-mover countries, the 50-in-5 campaign aims for 50 countries to design, launch and scale at least one DPI component by the end of 2028, in a safe, inclusive and interoperable way. It is led by a coalition including UNDP, the Digital Public Goods Alliance, the Centre for Digital Public Infrastructure, Co-Develop and the Bill & Melinda Gates Foundation, with support from GovStack, the Inter-American Development Bank and UNICEF. Its emphasis is on peer learning, shared tools and digital public goods.

What the international frameworks can and cannot do

These initiatives create a shared vocabulary and a set of expectations against which national projects can be compared. They give civil society and parliaments reference points. They can also influence donors and development banks, which increasingly finance DPI.

They cannot replace national law and institutions. A safeguards framework does not have a court, an auditor or a data protection authority. The quality of governance will be decided country by country, by statutes, budgets for oversight bodies, and the willingness of governments to publish data about failures as well as successes.

There is also a risk of "safeguards washing": adopting the language of frameworks in project documents while the operational reality, such as mandatory use, weak grievance systems or opaque data sharing, stays the same. The test is not whether a project cites the framework but whether its legal basis, oversight and published statistics match the commitments.

Questions to ask any DPI programme

Which law governs the system, and who can amend its purposes?
Who operates it, who sets the rules, and who regulates it? Are any of these independent?
When was it last audited externally, and is the report public?
Can people see who accessed their data, and complain effectively?
Are failure, exclusion and grievance statistics published?
How were civil society and affected groups consulted?