India's digital economy is at a crossroads. A new handbook for the Data Empowerment and Protection Architecture (DEPA) has proposed crucial new rules for sharing data, particularly for training AI systems, following its unveiling on October 31.
What is DEPA Anyway?
First,
let’s decode the alphabet soup. DEPA stands for the Data Empowerment and Protection Architecture. It's a government-backed framework designed to give Indians control over their own data. Think of it as a set of digital rails that allows you to securely share your information—like bank statements or health records—with your explicit consent. Instead of data being locked away in institutional silos, DEPA creates a way for it to flow securely between 'Data Providers' (like your bank) and 'Data Users' (like a new fintech app), all with you in the driver's seat. The most well-known application of this so far has been the Account Aggregator (AA) network in the financial sector, which helps streamline lending and personal finance management by making data portable.
The October 31 Release: A Catalyst for AI Rules
The headline's date is key. On October 31, 2026, India's Ministry of Electronics and Information Technology (MeitY) launched a specific handbook: 'DEPA for AI Training'. This wasn't just another policy paper; it was a direct response to one of the biggest challenges in the modern economy. As artificial intelligence becomes more powerful, it needs vast amounts of high-quality data to learn from. This 'training data' is often locked away in sensitive sectors like healthcare, finance, and governance. The new handbook, developed with support from the iSPIRT Foundation, outlines a techno-legal framework to solve this problem: how can institutions share data for AI training without compromising privacy, confidentiality, or intellectual property?
The Proposed Guardrails: How It Works
The handbook proposes a clever solution where, as India's Principal Scientific Adviser Ajay Kumar Sood put it, 'the model travels to the data' instead of the other way around. This means the raw, sensitive data never actually leaves the provider's secure environment. Here are the core guardrails proposed: 1. Secure Data Environments: AI models from 'Training Data Consumers' (like startups or researchers) would be brought into a controlled, sealed-off computing space to train on the data. The raw data itself is never exposed or downloaded. 2. Privacy-Enhancing Technologies: The framework calls for techniques like 'differential privacy', which adds statistical 'noise' to datasets. This makes it impossible to identify or reverse-engineer information about any single individual from the AI model's output. 3. Electronic Contracts and Provenance: Machine-readable contracts would automatically enforce the rules of data use. Furthermore, a 'provenance chain'—potentially using distributed ledger technology—would create an immutable record of the data's origin, the permissions granted, and how it was used, ensuring transparency and accountability. 4. Defined Roles: The system clearly defines the players: 'Training Data Providers' (hospitals, banks), 'Training Data Consumers' (AI developers), and 'Data Collabs' (intermediaries that pool sector-specific data).
The Big Picture for Indian Tech and Business
This framework is more than just a technical guideline; it's a strategic move to power India's AI ambitions, which MeitY estimates could add $500 billion in value by 2030. By creating a trusted mechanism for data sharing, the government hopes to unlock innovation that has been stalled by data access issues. For startups and researchers, it could mean unprecedented access to the kind of largescale, realworld data needed to build globally competitive AI solutions in fields like medical diagnostics, credit risk assessment, and more. For large institutions, it offers a way to monetise or contribute their data assets without the immense risk of data leaks or misuse. The handbook also aims to ensure these practices align with India's Digital Personal Data Protection (DPDP) Act of 2023. While the document is currently a draft for discussion, it signals a clear direction: India is building a regulated, privacyfirst ecosystem for the age of AI.
