Aadhaar and its regulations are governed by UIDAI and followed by numerous regulators such as RBI, IRDAI, TRAI and SEBI. The regulations pretty much mandates every business collecting Aadhaar cards to mask the first eight digits of the Aadhaar number once the KYC is completed. You can refer to the following regulations with regards to Aadhaar masking.
UIDAI regulation on Aadhaar Masking dated 23 October 2018: Ordinance Aadhaar Amendment: F.No.13012/171/2018/Legal/UIDAI/114
RBI regulation on Aadhaar Masking: Master Direction – Know Your Customer (KYC) Direction, 2016 (Updated 29 May 2019): RBI/DBR/2015-16/18, Master Direction DBR.AML.BC.No.81/14.01.001/2015-16 AND Amendment to Master Direction (MD) on KYC: RBI/2018-19/190,DBR.AML.BC.No.39/14.01.001/2018-19
IRDAI regulation on Aadhaar Masking dated 29 January 2019: Allowing of Aadhaar Card as one of the acceptable documents for KYC- under certain conditions: Ref: IRDAI/SDD/Cl R/MISC/020/01/2019
SEBI regulation on Aadhaar Masking dated 24 April 2020: Clarification on Know Your Client (KYC) Process and Use of Technology for KYC: Ref: SEBI/HO/MIRSD/DOP/CIR/P/202