As artificial intelligence transforms industries, the data used to train it has become a critical, yet risky, asset. A new handbook for India's Data Empowerment and Protection Architecture (DEPA) now proposes a set of guardrails to manage this risk.
Understanding the Data Deadlock
Artificial
intelligence learns from data. The more high-quality, relevant data an AI model can access, the more powerful and accurate it becomes. India possesses vast amounts of data across sectors like finance, healthcare, and public services that could fuel a new generation of AI solutions. However, this data is often locked away in institutional silos, a situation the new handbook calls a 'Data Deadlock'. For very good reasons—including privacy laws, commercial confidentiality, and security concerns—hospitals, banks, and government agencies cannot simply hand over their sensitive records to AI developers. This creates a fundamental challenge: how to unlock the value of this data for innovation without compromising the privacy and security of individuals and institutions. The DEPA for AI Training framework is designed to solve this very problem.
What is the DEPA for AI Training Framework?
The Ministry of Electronics and Information Technology (MeitY), in collaboration with the technology think tank iSPIRT Foundation, has released the 'Handbook on Data Empowerment and Protection Architecture (DEPA) for AI Training'. It outlines a techno-legal framework that allows companies, researchers, and startups to train AI models on large datasets without accessing the raw, sensitive information. The core concept, as described by India's Principal Scientific Adviser, is that 'the model travels to the data' rather than the other way around. Instead of data being moved and copied, which creates risk, the AI algorithms are brought into a secure, controlled environment where the data resides. This allows the model to learn without the underlying data ever leaving its protected space.
The Four Pillars of Protection
The proposed framework is built on four key technical pillars to ensure security and trust. First is a Data Exchange Platform, which acts as a registry for datasets. Second are machine-readable Electronic Contracts that automatically enforce the rules for how data can be used. The third and most critical pillar is the Secure Data Environment (SDE), a hardware-based confidential computing space where the AI training actually occurs, keeping the data encrypted even during processing. Finally, the framework uses Privacy-Enhancing Technologies like differential privacy, which adds statistical 'noise' to the data to prevent the identification of individuals from the outcomes of the AI model. Together, these components create a system where data providers can retain control and audit how their data is used.
Why This Matters for India's AI Ambition
The government projects that this framework has the potential to unlock $500 billion in AI-driven value for India's GDP by 2030. By enabling access to localised datasets, the initiative could help solve uniquely Indian challenges, from addressing the massive credit gap for small and medium enterprises to developing AI tools suited to the nation's linguistic and demographic diversity. It positions India to pursue a 'third way' in AI governance, distinct from the less-regulated US model and the compliance-heavy EU approach. This framework is part of India's larger strategy of building Digital Public Infrastructure (DPI), interoperable systems like UPI and Aadhaar that can be used by private companies to innovate. If successful, DEPA for AI Training could become another piece of DPI that India can offer to other developing nations.
The Road Ahead
The handbook is currently a draft proposal intended to spark discussion among government, industry, and academic stakeholders. While the technical architecture is detailed, key questions remain about implementation. For instance, the framework proposes a different approach to user consent than the one used for individual financial data, acknowledging that obtaining individual consent for large scale training is often impractical. The success of DEPA will depend on building trust among data providers and establishing clear, enforceable rules. The government plans to launch pilot programs in the finance and healthcare sectors, along with regulatory sandboxes, to test the framework in the real world. These initial steps will be crucial in refining the architecture and proving its ability to foster AI innovation responsibly.
