In a significant move to accelerate India's artificial intelligence ambitions, the Ministry of Electronics and Information Technology (MeitY) has introduced a new framework for sharing crucial data sets for AI training. But how does it work?
What Did MeitY Announce on 31 October?
On 31 October,
MeitY unveiled the 'Handbook on Data Empowerment and Protection Architecture (DEPA) for AI Training'. Rather than a strict new law, this is a draft techno-legal framework released for public consultation. Developed with support from the iSPIRT Foundation, the handbook's goal is to solve a major problem holding back AI development: access to high-quality, large-scale data. Many institutions like hospitals, banks, and government agencies hold valuable data but are hesitant to share it due to concerns about privacy, intellectual property, and losing control. The DEPA handbook proposes a structured way for these 'Training Data Providers' to collaborate with 'Training Data Consumers' like startups and researchers, without compromising on security.
The Core Idea: 'The Model Travels to the Data'
A key concept emphasized by the Principal Scientific Adviser to the Government of India, Ajay Kumar Sood, is that under this framework, 'the model travels to the data, rather than the data travelling to the model'. This means that instead of data owners sending their raw, sensitive datasets to AI developers, the developers' AI models are brought into a secure, controlled environment to be trained on the data. This approach allows institutions to retain control over their information, as the underlying data is never directly transferred or exposed. The DEPA framework combines contractual agreements with these controlled computing environments and other privacy-enhancing technologies to build a system based on trust and accountability.
What Are the Key Safeguards?
The handbook proposes several layers of protection. Firstly, it acknowledges that simply removing names from a dataset isn't enough to prevent re-identification. To counter this, it champions the use of 'secure data environments' where raw data is not exposed to developers. Secondly, it advocates for techniques like 'differential privacy', which adds statistical noise to the data, making it impossible to single out any individual's information from the trained model. The framework also incorporates 'data provenance' mechanisms. This acts like a logbook, tracking where the data came from, the permissions granted for its use, and how it was applied during AI training, ensuring a clear chain of accountability.
How This Fits with India's Data Laws
This new framework doesn't exist in a vacuum. It is designed to work alongside India's existing Digital Personal Data Protection (DPDP) Act, 2023. The DPDP Act already establishes core principles for data processing, including consent and purpose limitation. However, it doesn't fully address the specific challenges posed by AI training. The DEPA handbook aims to provide that specific guidance. While the DPDP Act provides an exemption for processing personal data for research or statistical purposes under certain conditions, the handbook suggests a consent-based model could still be central. This approach aims to provide greater clarity for companies navigating the legal requirements for using personal data in AI development.
What This Means for India's AI Ecosystem
For India's burgeoning AI industry, this is a pivotal development. Startups and research institutions often struggle to access the diverse, high-quality datasets needed to build and test globally competitive AI models. By creating a trusted mechanism for data sharing, MeitY hopes to unlock these valuable data resources and fuel innovation. The framework could be particularly beneficial for sectors like healthcare and finance, where data is abundant but highly sensitive. However, as the handbook is still a draft, the industry's feedback will be crucial. Smaller startups may have concerns about the compliance burden, a common challenge with new regulatory frameworks. The coming months of public consultation will determine the final shape of these rules and their real-world impact on innovation and privacy.
