Security and confidentiality of identity information require the Authority to secure records, restrict disclosure, and bind agents to equivalent obligations. The Authority must ensure security and confidentiality of identity information and authentication records, protect the Central Identities Data Repository against unauthorised access, use, disclosure, destruction, loss or damage, and implement appropriate technical and organisational measures. The Authority must ensure its agents maintain equivalent security obligations and act only on its instructions, and agreements with such parties must impose equivalent obligations. Disclosure from the Central Identities Data Repository is prohibited for Authority personnel and maintaining agencies, except that an Aadhaar number holder may request access to identity information excluding core biometric information as specified by regulations.