On the one hand Aadhar is so convenient. If I want a phone number or a bank account, I can simply identify myself with my thumbprints and iris scans and get it activated immediately without paperwork. This has really made things easier for people. Using biometrics also reduces fraud when claiming benefits from the government and maybe makes the process easier as there is again no paperwork, and it is easy to make claims.
But on the other hand, all this makes it so easy to track anyone. All your bank accounts, cards, phone numbers, internet connections would be linked to your Aaadhar number and would be centrally accessible. This is a privacy nightmare. I am already getting frequent messages from my phone company to link my phone number with my Aadhar number, or let it be deactivated.
All this information would be in the hands of government officials. The Indian bureaucracy is notorious for the corruption everywhere. What if you could purchase somebody's data through an "agent" - get access to everything that they do, everything they buy, everyone they transact with, everyone they communicate with, contents of every message they send to anyone at all - imagine the kind of possibilities this opens up for negative minds.
Besides this, someone could just hack the data and maybe leak all of it. Someone recently created an app that would let you get anyone's details including their phone number, address, etc. by typing in their Aadhar number. It was taken down a month ago. I'm not sure about the exploit but it was related to using plain http instead of https somewhere. I checked one of the Aadhar linked projects and found that they were using an open source library in the backend which wasn't up to date, and the version being used had some documented security vulnerabilities. I wonder how safe peoples' data really is.
A large number of Aadhar numbers have already been leaked thanks to government websites. It is possible to extract a person's fingerprint or iris scan using photos of their hands or the face in specific conditions. If the person has linked their bank account with Aadhar which is getting compulsory, one could take out money from their accounts by impersonating their prints or iris scans. Fortunately there is an option to protect yourself from this - go to the Aadhar website and lock your biometrics data. If used regularly this can protect people from "biometrics theft", but the biometrics are unlocked by default, and for 99% of the people they are going to stay that way.