India's Ministry of Electronics and Information Technology (MeitY) has unveiled a key handbook aimed at unlocking vast datasets for AI innovation. This move is designed to fuel the nation's AI ambitions while protecting sensitive information.
A Handbook for India's AI Future
On October
31, MeitY launched the 'Handbook on Data Empowerment and Protection Architecture (DEPA) for AI Training'. This isn't a new law, but a crucial techno-legal guide for how data can be shared and used to train artificial intelligence models. The goal is to solve a major problem for AI developers: getting access to large, high-quality datasets without compromising privacy, intellectual property, or institutional control. The handbook, developed with support from the iSPIRT Foundation, is currently a draft for discussion, inviting feedback from the public and industry stakeholders.
What is the DEPA Framework?
DEPA is not a new concept; it has already been successfully implemented in India's financial sector through the Account Aggregator system, which allows individuals to share their financial data with consent. The new handbook extends this consent-based architecture to the world of AI. It creates a structured way for organisations that hold data—like hospitals, banks, or government agencies—to share it with entities that need it for building AI, such as startups and researchers. The framework identifies these groups as 'Training Data Providers' and 'Training Data Consumers', with intermediaries called 'Data Collabs' that can pool data from multiple sources for specific sectors.
How 'The Model Travels to the Data'
A key principle of the DEPA for AI framework is the concept of 'the model travels to the data'. As explained by Principal Scientific Adviser Ajay Kumar Sood, this means that instead of data holders sending their sensitive datasets to AI developers, the AI models are brought into a secure, controlled environment where the data resides. This approach minimises the risk of data leaks and misuse. The framework combines several layers of protection, including contractual agreements for purpose-bound use, controlled computing environments, and privacy-enhancing technologies like data anonymisation and encryption.
Balancing Innovation and Privacy
The guidance comes at a critical time, as India charts its course on AI regulation. The country has so far opted against a single, overarching AI law, instead relying on existing regulations like the Digital Personal Data Protection (DPDP) Act and specific advisories. The DEPA handbook is designed to operate within the DPDP Act's principles, ensuring that even when data is de-identified for AI training, it is done so with accountability. It incorporates 'data provenance' mechanisms, which track the origin of the data, the permissions granted for its use, and how it was applied during training, creating a transparent audit trail.
What This Means for India's AI Ecosystem
This handbook is a significant step towards enabling the ambitious IndiaAI Mission, a government program with an outlay of over ₹10,000 crore aimed at building sovereign AI capacity. By providing a clear and secure protocol for data sharing, MeitY hopes to give Indian startups and researchers the resources they need to build globally competitive AI models. For example, the handbook suggests training credit models on aggregated GST filings to help small businesses, or using learner data to create adaptive educational tools. While the guidance provides clarity, it also places responsibility on all participants to ensure data is handled ethically, a crucial foundation for building what the government calls a 'trusted AI' ecosystem.
