The artificial intelligence boom runs on a simple currency: data. But sharing that data to train smarter AI is fraught with legal and ethical risks. A new handbook based on the DEPA framework proposes a novel path forward, offering guardrails without
new laws.
Understanding the DEPA Framework
The Data Empowerment and Protection Architecture (DEPA) is an Indian framework designed to give individuals control over their personal data, allowing them to share it securely and on their own terms. Conceptualised as the next layer of India's digital public infrastructure, following Aadhaar and UPI, DEPA aims to unlock the economic value of data currently held in silos by various institutions. It introduces 'Consent Managers', neutral third-party entities that facilitate data sharing between a data provider (like a bank or hospital) and a data user (like a fintech startup), but only with the explicit consent of the individual. This model was first implemented in the financial sector to enable services like cash-flow-based lending for small businesses that previously lacked access to formal credit. The goal is to foster innovation and competition by creating a seamless and secure data-sharing ecosystem built on user trust and control.
The AI Training Data Dilemma
Developing powerful and unbiased Artificial Intelligence requires vast quantities of high-quality data for training. However, accessing this data is a major hurdle. Institutions like hospitals, banks, and government agencies hold valuable datasets but are reluctant to share them due to significant concerns over privacy, intellectual property rights, and commercial confidentiality. Sharing raw, sensitive data creates risks of leaks and misuse, potentially violating privacy laws and eroding public trust. This data deadlock creates a bottleneck for AI innovation, preventing researchers and startups from building and refining models that could solve critical problems in sectors like healthcare and finance. The challenge is to find a way to make this data available for the collective good without compromising individual privacy or institutional control.
Inside the Handbook: A New Set of Guardrails
The 'DEPA for AI Training' handbook, unveiled by the Ministry of Electronics and Information Technology (MeitY) with support from the iSPIRT Foundation, proposes a techno-legal solution to this dilemma. Instead of moving raw data, the framework is built on the principle of 'the model travels to the data'. This means AI models are brought into a secure, controlled computing environment where the data resides. The framework combines several layers of protection: contractual permissions that define the purpose of data use, technical safeguards to protect privacy, and data provenance mechanisms to track how data is used throughout the training process. This approach allows institutions to retain full control over their datasets while enabling trusted collaboration. The handbook also makes a crucial distinction, noting that seeking individual consent for large-scale AI training is often impractical, shifting the consent model for this specific purpose.
Why a Handbook and Not a Binding Law?
The decision to release a handbook—a set of non-binding guidelines—rather than enacting a rigid new law is a deliberate strategic choice. The field of AI is evolving at an unprecedented pace, and inflexible legislation risks quickly becoming outdated or stifling innovation. A 'soft law' approach provides an agile and adaptable framework that can be refined through pilots and consultations with stakeholders from industry and academia. It encourages voluntary adoption of best practices and allows for experimentation in regulatory sandboxes, particularly in initial focus areas like finance and healthcare. This method aims to build consensus and establish responsible norms from the ground up. While it may lack the immediate enforcement power of a statute, this flexible approach allows India to develop a practical governance model that balances the urgent need for AI development with the equally important principles of data protection and ethical use.
