Passport data is sensitive, so security is part of the model, not an afterthought.
Data minimisation (DPDP Act)
The org never stores the Aadhaar number. It keeps only Aadhaar_Verified__c (checkbox) and Aadhaar_Token__c (an opaque token). In a real org the token would sit behind Shield encryption.
Field-level security
New fields are hidden by default. Access is granted through a PSK_App_Access permission set rather than editing profiles directly.
Collect the least you can. Prove verification without holding the identifier.