Skip to content

Raising the IQ of government

Digital public infrastructure: what DPI is, how it works and what can go wrong

A plain guide to the shared digital systems behind modern states: the definitions, how identity, payments and data exchange work, real systems in every region, who pays, what goes wrong and how to judge one, with a source for every fact.

Updated 25 October 2026. Reviewed every quarter. Every fact links to its source.

Digital public infrastructure, or DPI, is the name now used for a small set of shared digital systems that a whole society can build on: a way to prove who you are, a way to pay and be paid, and a way for organisations to exchange data safely. The G20 leaders’ declaration agreed in New Delhi in September 2023 describes DPI as ‘a set of shared digital systems, built and leveraged by both the public and private sectors’ that ‘can enable delivery of services at societal-scale’. The World Bank compares these building blocks to ‘highways or bridges in the physical world’: shared platforms that many public and private services can use.

The best-known examples are India’s Unified Payments Interface (UPI), Brazil’s Pix and Estonia’s X-Road. This guide explains what the term means and what it does not, how DPI differs from digital public goods, how the three building blocks work, real systems in every region, who pays for them, what goes wrong and how to judge a system. It draws on IQGov’s government index and our reporting. For the wider picture, see the guide to digital government; for identity in depth, see the guide to digital identity.

What digital public infrastructure means

There is no single legal definition, and the word is used loosely. The most widely cited wording comes from India’s G20 presidency in 2023. The leaders’ declaration calls DPI ‘an evolving concept’, built on ‘secure and resilient infrastructure’, which ‘can be built on open standards and specifications, as well as opensource software’. The leaders welcomed a G20 Framework for Systems of Digital Public Infrastructure, described as ‘a voluntary and suggested framework for the development, deployment and governance of DPI’.

The UN Development Programme (UNDP) uses a longer version in its playbook, published in August 2023 during India’s G20 presidency. There, DPI is ‘a set of shared digital systems which are secure and interoperable, built on open standards and specifications to deliver and provide equitable access to public and/or private services at societal scale’, governed by enabling rules ‘to drive development, inclusion, innovation, trust, competition and respect human rights and fundamental freedoms’. The playbook says this wording was based on reviewing conceptions from the World Bank, the Digital Public Goods Alliance, the OECD, Co-Develop, GovStack and others.

The building blocks. Most definitions name the same three systems. The World Bank lists ‘digital identification, interoperable digital payment platforms, and secure data exchange’. The 50-in-5 campaign, a country-led effort to spread DPI, describes it as ‘a secure and interoperable network of components that include digital payments, ID, and data exchange systems’.

The idea of rails. DPI is often explained by analogy with railways and roads. UNDP’s playbook says physical infrastructure such as railroads ‘laid the foundation for private innovation and societal development’, and that similar systems are now being built in the digital domain ‘to simplify the flow of people, money and information’. India’s Press Information Bureau describes identity, payments and data exchange in India as connected ‘through interoperable public rails’. The state, or a body it controls, governs a narrow shared layer, and others build services on top. IQGov’s analysis The state as a platform looks at four of these systems.

What DPI is not. It is not a single app, a portal or a ministry’s website, which are services that may run on DPI. Co-Develop, a non-profit fund that finances DPI work, puts it this way: ‘DPI is not a technology output. It is services deployed with a specific approach along side strong governance, thoughtful policies, and deep civil society engagement.’ Nor does DPI have to be built or run by the state alone: the G20 text speaks of systems ‘built and leveraged by both the public and private sectors’, and the UN’s safeguards work covers systems ‘provided by, or on behalf of, government or through public–private partnerships at societal scale which serve the public interest’.

DPI vs digital public goods vs digital public services

Three terms are often confused. They describe different things, and one system can be more than one of them.

How they fit together. A DPG can be the software inside a country’s DPI, but it does not have to be. UNDP’s playbook says ‘a country’s DPI can include multiple proprietary and/or open-source solutions like DPGs’. X-Road shows the overlap: the software is open source, and the DPGA approved it ‘both as a DPG and as relevant digital public infrastructure’. MOSIP, an open-source identity platform, is described by the DPGA as a digital public good that offers ‘the core modules needed to create a vendor-neutral and interoperable solution’ for a country’s foundational ID system. Once a government deploys it at national scale and sets rules for its use, it is part of that country’s DPI.

The DPI approach. Many organisations now talk of a ‘DPI approach’ rather than a list of systems. UNDP describes it as ‘situated at the intersection of technology, governance, and local ecosystems’, with three pillars: open, interoperable technology; robust governance; and resilient local ecosystems. Its playbook contrasts it with a conventional approach marked by ‘high-cost, closed-loop solutions that create barriers for integration’ and ‘power concentrated in private entities or the state’. Co-Develop says DPI should be guaranteed by public institutions to be ‘1) inclusive, 2) foundational, 3) interoperable, and 4) publicly accountable’.

Safeguards. Because DPI reaches a whole population, mistakes reach everyone too. The UN Office of the Secretary-General’s Envoy on Technology and UNDP launched the DPI Safeguards initiative in September 2023, and published the Universal DPI Safeguards Framework in September 2024. It involved 44 DPI experts, 13 international organisations and 12 countries, and sets out risks, nine foundational principles, nine operational principles and about 300 processes and practices. The initiative’s website now offers version 2.0 of the framework. In the Global Digital Compact, adopted on 22 September 2024 at the UN Summit of the Future, member states recognised the potential of DPI and the role of adaptable safeguards.

The building blocks: identity, payments and data exchange

Digital identity. A trusted way to prove who someone is comes first, because payments and data sharing depend on knowing who is asking. India’s Aadhaar is the largest example: by March 2026 more than 144 crore (1.44 billion) Aadhaar numbers had been generated, according to the Press Information Bureau. Many countries now build identity on open-source software: MOSIP, established in 2018 at the International Institute of Information Technology Bangalore, reported 32 country engagements and 14 national rollouts on its website on 25 October 2026. IQGov’s guide to digital identity covers the models, standards and risks in depth, so this guide does not repeat them.

Instant payments. A public payment rail lets any account send money to any other in seconds, whichever bank or app each person uses. Co-Develop, citing the Centre for Digital Public Infrastructure, calls UPI and Pix ‘the world’s top two real-time digital payment systems’. They are run on different models.

The difference is in who holds the controls. UPI is run by NPCI, and most of its transactions go through third-party apps such as PhonePe and Google Pay, so competition between apps matters (see ‘Risks’ below). Pix’s rules are set by the central bank, which operates its settlement system and consults the market through the Fórum Pix; Pix had 926 participating institutions at the end of 2025. Rails can also be linked across borders: Singapore’s PayNow and India’s UPI were connected on 21 February 2023, in what the Monetary Authority of Singapore called the world’s first real-time payment systems linkage to use scalable cloud-based infrastructure.

Data exchange. The third block lets one organisation ask another for a record, so the citizen does not have to fetch it. Estonia’s X-Road is the best-known model. e-Estonia calls it ‘the backbone of e-Estonia’: an open-source system for secure data exchange between public and private organisations, in which ‘all outgoing data is digitally signed and encrypted, and all incoming data is authenticated and logged’. It is a layer, not a central database. Estonia’s Information System Authority (RIA) says each member describes the data it shares and others use it ‘based on an agreement’, following ‘the principle that the owner controls the data throughout the whole process’.

Names matter here. Estonia’s own exchange is now called X-tee; since 2018, RIA says, X-Road refers to the technology developed jointly by Estonia, Finland and Iceland through the Nordic Institute for Interoperability Solutions (NIIS), which now manages the software. NIIS’s website said on 25 October 2026 that its products ‘help power digital services for 783 million people worldwide’. X-Road also supports federation between countries: the federation between Estonia and Finland was established in February 2018. Data exchange is not only a government idea: Singapore’s SGFinDex, a joint project of the central bank and GovTech, is ‘a digital public infrastructure that uses national identity and centrally managed online consent system for secure access to financial data’; people use Singpass to pull their own bank, insurance and government financial data together, and the exchange ‘cannot read and does not store the user’s personal financial data’.

Digital public infrastructure examples from every region

These systems were chosen because published figures about them can be checked; each figure carries the date it refers to, or the date the page was read. The table after them shows each country’s place in the UN’s E-Government Development Index.

India, Asia. The Press Information Bureau says India’s systems are known as India Stack, which ‘unlocks the core building blocks of identity, data and payments at population scale’, built on open APIs (application programming interfaces). Besides Aadhaar and UPI, the DigiLocker document wallet, launched in 2015, had 67.63 crore (676 million) users on 5 March 2026. As of March 2026, UPI was live in eight countries, including the United Arab Emirates, Singapore, Bhutan, Nepal, Sri Lanka, France, Mauritius and Qatar, though the Press Information Bureau notes that international merchant payments there are accepted at select merchant outlets. As of February 2026 India had signed agreements on India Stack and DPI with 24 countries. See Sri Lanka’s digital ID pilot, Aadhaar abroad and a public stack for tourism.

Kyrgyzstan, Asia. Kyrgyzstan built its Tunduk data exchange on X-Road after rejecting a foreign vendor’s system whose source code was proprietary, according to a case study prepared with the DPGA Secretariat and published on the X-Road website. Tunduk processed 363,000 data exchange transactions in 2018 and 3.5 billion in 2024, when 37 state agencies provided services through it; 185 public and commercial institutions were using it by mid-2025. The government estimated that the platform saved citizens 21 million hours and 1.7 billion soms (around $19 million) in 2024.

Cambodia, Asia. Cambodia deployed the open-source X-Road code in 2020 to create CamDX, its national data exchange, run by the Techo Startup Center under the Ministry of Economy and Finance. Business registration was one of its first services, and Nguonly Taing, executive director of the Techo Startup Center, says ‘only metadata is accessible to the operator of CamDX’. See also Indonesia’s QR payment standard for visitors.

Estonia and Finland, Europe. According to e-Estonia’s website, which gives no date for the figures (read 25 October 2026), Estonia’s X-tee carries 2.2 billion transactions a year, with over 3,800 e-services and 78,000 organisations as indirect users. Finland runs its own exchange on the same technology, Suomi.fi-palveluväylä. NIIS’s associate members include Ukraine, Québec and the Faroe Islands.

United Kingdom, Europe. The Government Digital Service said in October 2026 that the UK is investing £12 million in data sharing infrastructure, starting with the National Node Net, an ‘open-source, Crown-IP’ system. See UK puts £12 million into data sharing and GOV.UK Pay at ten.

Ethiopia, Africa. Fayda, the national digital ID, is built on MOSIP, and had more than 52 million registrations, 150 integrated partners and over 208 million electronic know-your-customer verifications as of 9 October 2026, according to Biometric Update. In October 2026 Ethiopia joined the Pan-African Payment and Settlement System (PAPSS), which lets banks pay across African borders in local currencies; operational access depends on implementation by each institution, TechAfrica News reported. See Ethiopia joins the pan-African payment system.

Pan-African payments, Africa. PAPSS is ‘the brainchild of Afreximbank’, Africa’s trade finance bank, and works with the continent’s central banks so that commercial banks, payment providers and fintechs can connect as participants. At the October 2026 announcement its chief executive, Mike Ogbalu III, said the network spans over 15 countries, including Kenya, Malawi, Nigeria, Tunisia and Zambia, and links more than 150 commercial banks, ITWeb Africa reported. Kenya and Sierra Leone are among the countries with agreements with India on India Stack and DPI. See also South Africa’s digital ID roadmap.

Brazil, Americas. Beyond Pix, the central bank says Pix keys, the aliases people use instead of account details, passed 920 million at the end of 2025. Brazil is also one of the countries in the 50-in-5 campaign.

Colombia, Americas. Bre-B, the instant payment system of Colombia’s central bank, the Banco de la República, went into mass operation on 6 October 2025, Actualícese reported. By early April 2026, the business daily Portafolio said in an editorial, more than 34.6 million users had registered 103.3 million keys, and 638.6 million transactions worth more than 100 trillion pesos had been processed in its first half-year, with 196 participating entities.

Papua New Guinea, Oceania. SevisPass, the national digital ID, and the SevisWallet app were launched in late 2025, according to a GovInsider article by the DPI programme lead at the Department of Information and Communications Technology and an adviser at the Centre for Digital Public Infrastructure. The need is large: as of early 2026 only about 4.2 million of an estimated 10.1 million people had been registered under the national ID system since 2014. The authors say data ‘stays federated’, remaining with authorised custodians rather than being stored centrally, and that setting up both apps comes at no additional cost to the individual. Papua New Guinea is a 50-in-5 country and has an agreement with India on DPI, as does Fiji.

Elsewhere in Oceania. MOSIP lists Tonga among its country engagements, and on 25 October 2026 the Global DPI Repository listed two systems under Australia, including the Australian Government’s Digital ID System.

IQGov’s reading of the table: well-known DPI is not confined to countries at the top of the UN’s e-government ranking. India, whose UPI is the largest system in this guide, ranks 97th, and Ethiopia and Papua New Guinea, both building national ID now, rank near the bottom. The index also scores telecommunications and human capital, not only online services. Every country’s scores are on its profile and in the government index.

Who pays and who governs: funding, open source and global initiatives

Funding. UNDP’s playbook calls funding ‘a critical, lifelong process’ and warns that grants are ‘unreliable for long-term financing’ because most run for a fixed period. The UN framework adds that, because DPI is public infrastructure, ‘diversified, phased and sustainable financing models should be established’, with governments leading the build and local partners or the private sector able to lead on operations. Donor money runs out: Madagascar’s chief digital officer, Tahina Razafindramalo, said in a 2021 interview published on the X-Road website that after a donor-funded period ‘we must finance it internally from the government’. See also Sri Lanka’s funding gap.

Governance. Someone has to own the rules. In Brazil the central bank runs Pix and consults the market through the Fórum Pix; in India, NPCI operates UPI under the regulatory oversight of the Reserve Bank of India. The UN framework’s principles call for DPI to be introduced ‘with a clear legal basis’ and for all partnerships to be ‘transparent, accountable and publicly governed’.

Open source or proprietary. The G20 text says DPI ‘can be built on’ open-source software, not that it must be. UNDP’s playbook says a country’s DPI can include proprietary and/or open-source solutions, and the UN framework asks DPI to ‘share and reuse open protocols, specifications, Digital Public Goods (DPGs), and the associated knowledge’ so that proprietary systems do not limit safety and inclusion. Open source is not free to run: the DPGA says DPGs help avoid vendor lock-in, but Kyrgyzstan still needed training for at least 260 civil servants, IT specialists, developers and lawyers and years of work to get agencies connected.

International initiatives. Four are cited most often:

  • G20 New Delhi, 2023. Besides the framework, the leaders welcomed India’s plan for a Global Digital Public Infrastructure Repository and took note of a proposed One Future Alliance to fund and support DPI in low- and middle-income countries.
  • Global DPI Repository. On 25 October 2026 the repository listed 54 systems from 16 contributors, India’s 12 the most; 21 are tagged data exchange, 11 identity and 6 payment.
  • 50-in-5. Launched on 8 November 2023, the campaign aims for 50 countries to have designed, launched and scaled at least one DPI component by 2028. On 25 October 2026 its site listed 41 countries, from Algeria and Bangladesh to Ukraine and Zambia. Its partners include the DPGA, the Gates Foundation, Co-Develop, UNDP and the UN Office for Digital and Emerging Technologies.
  • Co-Develop. A ‘global non-profit fund’ that invests to unlock bottlenecks in the adoption of DPI and to learn about its impact, with an aim of supporting 50 countries in five years.

The risks: exclusion, surveillance, lock-in, concentration and outages

The UN’s safeguards framework groups the dangers into risks to safety, risks to inclusion and structural weaknesses such as weak rule of law and ‘unsustainability’. Each has real examples.

Exclusion. A system that everyone must use shuts out those who cannot. The framework warns that ‘exclusion also occurs when enrolment in DPI systems is onerous, impossible or causes unease’, especially where it is required to access services, and its principles say people should have ‘a choice of channels (digital/non-digital)’. In Papua New Guinea, only 5 per cent of those registered for the national ID had received their physical card by early 2026. See The offline citizen.

Privacy and surveillance. Joining up identity, money and data makes misuse easier. The framework notes that privacy breaches ‘may enable governments to unlawfully access and misuse data to infringe upon human rights through unauthorized surveillance’. Design can limit this: X-Road logs every request and leaves data with its owner; CamDX’s operator sees only metadata; SGFinDex releases data only ‘after the user has given consent’. The court cases on India’s Aadhaar and Kenya’s Huduma Namba are covered in the guide to digital identity.

Vendor lock-in. The framework says lock-in ‘limits flexibility and adaptability to new technologies, leading to long-term costs’. Before Tunduk, Nuria Kutnaeva, who led the Tunduk State Enterprise, recalled a ‘zoo’ of disconnected, proprietary systems, and the hardest agencies to persuade were those that ‘already had a proprietary solution and were locked into existing vendor contracts’. See Who owns the government cloud?.

Concentration. A public rail can still be dominated by a few private apps. NPCI introduced a rule in November 2020 to cap any single third-party UPI app at 30 per cent of transaction volume, and in December 2024 extended the deadline for existing apps to 31 December 2026. According to NPCI data reported by Outlook Business, the combined share of PhonePe and Google Pay fell to 79 per cent in May 2026, the first time it had dropped below 80 per cent since NPCI began publishing figures for individual apps. The UN framework warns that ‘concentration of power in the form of monopolies may inhibit innovation’.

Outages. When one system carries most payments, its failures stop daily life. On 12 April 2025 NPCI said it was ‘currently facing intermittent technical issues, leading to partial UPI transaction declines’; Business Today reported a separate outage on 26 March that left users without UPI for up to three hours. NPCI later said the April disruption was caused by an unusually high volume of requests from some banks, and told them to stop using the ‘Check Transaction’ API; according to Outlook Money, the payment success rate fell to about 50 per cent for nearly two hours.

Fraud. Speed helps criminals too. Brazil’s central bank says its own systems ‘nunca foram vítimas de ataques bem-sucedidos’ (have never been successfully attacked), but that fraud, scams and attacks on participating institutions increasingly use Pix as a channel. Since October 2025, users can dispute suspect transfers directly in the app of their bank or payment provider through a self-service version of the special refund mechanism (MED). See Pix rules tighten on fraud.

How to judge a DPI system

The questions below are IQGov’s own synthesis of the frameworks cited in this guide, chiefly the UN safeguards framework, UNDP’s playbook and the G20 text.

Questions

What is digital public infrastructure in simple terms?
It is the shared systems a country uses to prove identity, make payments and exchange data, which many public and private services build on. The G20 called it ‘a set of shared digital systems’ that can deliver services at societal scale.
What are examples of digital public infrastructure?
India’s UPI payments and Aadhaar identity, Brazil’s Pix, Estonia’s X-Road data exchange (X-tee), Singapore’s SGFinDex, Kyrgyzstan’s Tunduk, Ethiopia’s Fayda ID and Papua New Guinea’s SevisPass. The Global DPI Repository listed 54 systems on 25 October 2026.
What is the difference between DPI and digital public goods?
Digital public goods are open assets, such as open-source software, open standards and open data, that meet the DPGA’s standard. DPI is a shared system in use across a society, with rules that govern it. A country’s DPI can include proprietary and/or open-source solutions; X-Road is recognised as both.
What is India Stack?
It is the name for India’s connected set of digital public systems, built on open APIs, which India’s Press Information Bureau says ‘unlocks the core building blocks of identity, data and payments at population scale’: Aadhaar for identity, UPI for payments and platforms such as DigiLocker for documents.
What is UPI and how does it compare with Pix?
UPI is India’s instant payment system, run by NPCI under the Reserve Bank of India’s oversight, with more than 24,162 crore (241.6 billion) transactions in 2025–26. Pix is Brazil’s, developed by the central bank, which runs its settlement system, with almost 80 billion transactions in 2025. Most UPI transactions go through third-party apps; Pix’s rules are set by the central bank. Read more in Pix and the politics of instant money.
What is X-Road?
X-Road is open-source software for secure data exchange between organisations, first used in Estonia and now managed by the Nordic Institute for Interoperability Solutions. Data stays with its owner, and requests are signed, encrypted and logged. e-Estonia’s website (undated, read 25 October 2026) says Estonia’s instance, X-tee, carries 2.2 billion transactions a year.
Is DPI the same as digital government?
No. Digital government is the wider change in how the state works and serves people; DPI is the shared layer of identity, payments and data exchange that much of it runs on. See the guide to digital government.
What are the main risks of DPI?
Exclusion of people who cannot enrol, misuse of data for surveillance, dependence on one supplier, dominance by a few private apps and outages that stop payments, such as UPI’s disruption on 12 April 2025. The UN’s safeguards framework sets out principles to reduce them.

IQGov reporting on this