As India solidifies its ambition to become a global AI powerhouse, the Ministry of Electronics and Information Technology (MeitY) has introduced a pivotal guide. This new handbook details a framework for using data responsibly to train AI.
A New Rulebook for the AI Gold Rush
On October 31,
2026, MeitY, with support from the iSPIRT Foundation, launched the Handbook on Data Empowerment and Protection Architecture (DEPA) for AI Training. This isn't a new law, but a detailed techno-legal framework. Its goal is to solve a critical puzzle: how can India's burgeoning AI industry use the vast and sensitive data held by banks, hospitals, and public agencies to build powerful models without compromising individual privacy, intellectual property, or data security? The handbook outlines a path for this 'trusted data collaboration', aiming to unlock innovation that might otherwise be stifled by legal and privacy concerns.
Decoding DEPA: Your Data, Your Control
At its core, the Data Empowerment and Protection Architecture (DEPA) is a concept designed to give individuals control over their personal data. First conceptualised by NITI Aayog, it aims to shift the data-sharing paradigm from an organisation-centric model to an individual-centric one. Instead of companies having broad, often unclear rights to use your information, DEPA introduces 'Consent Managers'. These are neutral third-party entities that allow you to grant specific, granular, and temporary consent for your data to be shared for a particular purpose. Think of it like a digital remote control for your data, ensuring it's only used how and when you approve. This consent-based architecture has already been rolled out in the financial sector through the Account Aggregator network.
The Model Travels to the Data
The DEPA for AI Training handbook introduces a revolutionary idea, summarised by Principal Scientific Adviser Ajay Kumar Sood: 'the model travels to the data, rather than the data travelling to the model'. Traditionally, AI development requires collecting massive datasets and moving them to a central server for training. This creates huge privacy risks. The DEPA framework flips this. Instead of raw data being sent out, the AI algorithm is brought into a secure, controlled environment where the data resides. This process uses a combination of contractual agreements, secure computing environments, and privacy-enhancing technologies like differential privacy, which adds 'noise' to data to protect individual identities. This allows the AI to learn from sensitive health or financial records without developers ever seeing or copying the raw data itself.
Unlocking Billions in Economic Value
The stakes are enormous. According to the framework's draft, unlocking these data silos could add an estimated $500 billion in AI-driven value to India's GDP by 2030. Proponents argue this approach is critical for domestic innovation. It gives Indian startups and researchers access to highstquality, localised datasets that are essential for building AI solutions tailored to India's unique challenges, from its linguistic diversity to its specific disease burdens. For example, it could help address the estimated ₹20–25 trillion credit gap for Micro, Small, and Medium Enterprises (MSMEs) by allowing for better credit risk modelling without exposing sensitive financial data. The framework ensures that smaller players can compete and innovate, preventing a market where only large corporations with deep pockets can afford to license data.
A 'Third Way' for Global AI Governance
With this handbook, India is positioning itself as a leader in AI governance, charting a course distinct from the US's largely market‐driven approach and the EU's comprehensive regulatory regime. This 'third way' is built on using digital public infrastructure to enforce rules, rather than relying solely on legislation. By creating a technical and architectural standard for responsible data use, DEPA provides a scalable model that balances innovation with rights. It also serves as a form of 'science diplomacy', offering a blueprint for other developing nations that want to build their own sovereign AI capabilities without surrendering data sovereignty to foreign tech giants.
