India’s AI ambitions hinge on one critical resource: data. The challenge is accessing it ethically while protecting user privacy. Enter the DEPA framework, a novel approach to give citizens control over their data without creating a new active law.
What Is DEPA, Exactly?
DEPA
stands for Data Empowerment and Protection Architecture. The key word here is 'architecture'. Unlike a traditional law that sets out rules and punishments, DEPA is a set of technical specifications and open standards. It’s essentially a blueprint for a secure, consent-based system for sharing data. Think of it not as a new rulebook, but as a standardized plumbing system that allows personal data to flow from a 'Data Provider' (like a bank or hospital) to a 'Data User' (like a lending app or an AI research firm), but only with the explicit and granular permission of the individual who owns that data. The goal is to move from a model of 'data harvesting', where companies collect as much as they can, to 'data empowerment', where individuals decide who can use their data, for what purpose, and for how long.
The Role of Consent Managers
The magic of DEPA lies in a new type of entity called a 'Consent Manager'. These are regulated third-party applications that act as the user's personal data remote control. When an app or service wants access to your data, it doesn't ask you directly. Instead, it sends a request to your chosen Consent Manager. You then see a clear, simple request in one place: 'XYZ App wants to view your bank statements from the last six months to process a loan application. Do you approve?'. You can approve, deny, or even set a time limit on the access. Your consent is auditable, machine-readable, and easily revocable. This puts the user firmly in the driver's seat, managing all their data-sharing permissions from a single, trusted dashboard instead of navigating dozens of different privacy policies.
Working With The Law, Not Above It
The headline's claim that DEPA works without creating a 'new active law' is crucial. DEPA is not a legal vacuum; it is designed to operate within the framework of existing legislation, most notably India's Digital Personal Data Protection (DPDP) Act. The DPDP Act lays down the legal principles of data processing—purpose limitation, data minimization, and the requirement for consent. DEPA provides the technological means to implement these principles efficiently and at scale. By creating a standardized technical layer, it allows companies to be compliant by design. This approach is more agile than waiting for lawmakers to draft new regulations for every technological shift, ensuring that governance can keep pace with innovation.
Fueling the Artificial Intelligence Engine
The connection to AI is where DEPA’s potential becomes transformative. High-quality, labelled data is the lifeblood of modern AI systems. Currently, most of this data is held by a few large corporations. DEPA could democratize access to this fuel. For instance, individuals could consent to share their anonymized health data with researchers developing AI-powered diagnostic tools. Or they could allow their anonymized financial data to be used to train AI models that offer better financial products. This creates a regulated and ethical marketplace for data, where individuals can potentially be compensated for contributing their information. It allows for the creation of diverse, India-specific datasets that are essential for building AI that is relevant and unbiased for the Indian population.
From Theory to Reality
This isn't just a theoretical concept. A real - world implementation of DEPA already exists and is thriving in India's financial sector. The Account Aggregator (AA) network is built on DEPA's principles. It allows individuals to securely share their financial information from different banks, insurance providers, and investment funds with lenders or financial advisors, all through a regulated Consent Manager. The success of the AA network, which has seen rapid adoption, serves as a powerful proof of concept. It demonstrates that a consent - based data - sharing ecosystem can work, creating efficiency for businesses and empowering consumers. The vision is to extend this model to other sectors, including healthcare, skilling, and eventually, the broader digital economy.
