India's ambition to become a global AI powerhouse hinges on one critical resource: data. The Ministry of Electronics and IT (MeitY) has now unveiled a plan to unlock this resource, releasing a handbook for the DEPA framework.
What is the DEPA Handbook?
On October 31, 2026, MeitY
launched the 'Handbook on Data Empowerment and Protection Architecture (DEPA) for AI Training'. Developed with support from the iSPIRT Foundation, this handbook provides a techno-legal framework for institutions like banks, hospitals, and government agencies to share data for training AI models. The goal is to solve a major challenge: data holders are often reluctant to share information due to concerns about privacy, intellectual property, and losing control. This guide creates a structured pathway for collaboration, enabling responsible data use while ensuring that data providers retain control over their valuable information. It outlines a combination of contractual agreements, secure computing environments, and privacy-enhancing technologies to build trust in the data-sharing ecosystem.
Understanding the DEPA Framework
DEPA, or the Data Empowerment and Protection Architecture, is not a new law but a foundational framework designed to give Indians control over their personal data. It's a key part of the 'India Stack', a set of digital public infrastructures. At its core, DEPA operates on a consent-based model. It introduces regulated entities called 'Consent Managers' (like Account Aggregators in the financial sector) who act as intermediaries. Through these managers, you can grant, manage, and revoke consent for your data to be shared between different service providers in a secure and machine-readable format. This replaces older, insecure methods like sharing passwords or physical documents, creating an auditable trail for how and why your data is used.
How DEPA Enables Responsible AI
The handbook applies DEPA's principles to the complex world of AI. Instead of data travelling to the AI model, the new approach allows the 'model to travel to the data'. This means developers can train their algorithms on sensitive datasets without ever seeing or moving the raw data itself. This is achieved through secure data environments and techniques like differential privacy, which adds statistical 'noise' to data to protect individual identities. The framework also introduces the concept of 'Data Collabs' — intermediaries that can pool data from multiple sources for specific sectors like healthcare or finance. Furthermore, it uses 'data provenance' mechanisms to track the origin, permissions, and use of data throughout the AI training process, ensuring transparency and accountability.
Why This Matters for India's AI Ambitions
Access to diverse, high-quality data is the primary bottleneck for many Indian AI startups and researchers. This framework aims to level the playing field, allowing smaller players to develop innovative, localised AI solutions that can compete with global tech giants. MeitY believes this initiative could unlock immense economic value, potentially adding $500 billion to India's GDP by 2030. For example, by using alternative data for AI-powered underwriting, it could help address the massive credit gap for micro, small, and medium enterprises (MSMEs). By establishing a trusted mechanism for data sharing, DEPA could fuel innovation across sectors, from finance and healthcare to agriculture, accelerating India's journey to becoming a leader in responsible AI.
Balancing Innovation with Privacy
The DEPA for AI training framework is designed to operate within India's legal landscape, particularly the Digital Personal Data Protection (DPDP) Act of 2023. The DPDP Act includes provisions for data processing for research and statistical purposes, which may be relevant to the DEPA framework's implementation. The handbook carefully distinguishes between using an AI model on an individual's data (inference) and using aggregate data to build a model (training). While individual consent remains a cornerstone of DEPA, the handbook navigates the nuances of consent for large scale training. The proposed model includes oversight from self regulatory organizations and a 'competent government authority' that would certify trained models as fit for use, ensuring that innovation does not come at the cost of citizen rights.
