Artificial intelligence has an insatiable appetite for data, but feeding it has created a minefield of privacy and ethical concerns. Now, a new framework in India aims to solve this dilemma, putting individual data rights at the heart of AI development.
What is DEPA?
DEPA, or the Data Empowerment and Protection Architecture, is not a single law but a foundational framework designed for India's digital economy. First proposed years ago, its core idea is to shift control over personal data from the companies that collect it back to the individuals it belongs to. Think of it as a set of rules and technology standards that allow you to grant specific, temporary, and revocable permission for your data to be used. This is managed through intermediaries called 'Consent Managers'. The most well-known application so far has been in the financial sector through the Account Aggregator network, which allows users to securely share their financial data with lenders or advisors with explicit consent for each transaction.
The AI Data Dilemma
High-quality AI models require massive amounts of data for training. The more relevant and diverse the data, the better the AI performs. However, this has led to a 'data deadlock'. Valuable information is locked away in institutional silos—like banks, hospitals, and government agencies—because sharing it raises significant privacy, security, and intellectual property concerns. Unregulated data harvesting has eroded public trust, while overly restrictive rules can stifle innovation. The challenge is to unlock the value of this data for AI development without compromising individual privacy and institutional control.
A New Framework for AI Training
Recognising this challenge, the Ministry of Electronics and Information Technology (MeitY) recently unveiled a specific handbook for using DEPA for AI training. The framework creates a structured ecosystem for data collaboration. It introduces 'Training Data Providers' (like hospitals and banks), 'Training Data Consumers' (AI developers and researchers), and 'Data Collabs' (intermediaries that pool data). This techno-legal framework aims to allow institutions to collaborate on AI projects by providing controlled access to their data, rather than transferring raw datasets. A key concept is that the 'model travels to the data', not the other way around, often within secure, controlled computing environments.
Rethinking Consent for AI Scale
The new guidance makes a crucial distinction between AI 'inference' (using a model on one person's data, like for a loan application) and AI 'training' (building a model from vast datasets). While the original DEPA is built on explicit, individual consent for every transaction, the handbook for AI training suggests this is 'impractical at this scale'. Instead of individual consent for every piece of data used in a massive training set, the framework emphasizes institutional responsibility and technical safeguards. Data providers must de-identify or anonymize data, and it is processed using privacy-enhancing technologies like differential privacy and within secure environments where developers cannot see the raw information. This has sparked debate, with some experts noting it shifts agency from the individual to the institution holding the data.
The Future of Data Collaboration
By putting a formal structure around data sharing, the DEPA for AI Training framework aims to build trust and make collaboration more transparent and scalable. It relies on electronic contracts to define clear rules for data access, use, and duration. It also uses data provenance mechanisms to track the origin and use of data throughout the AI training process. The goal is to create a trusted ecosystem where startups, researchers, and large firms can innovate responsibly. Proponents believe this could unlock immense economic value—potentially contributing up to $500 billion to India's GDP by 2030—by creating a competitive advantage based on high-quality, ethically-sourced data.
