India's IT ministry unveils draft DEPA framework to open sensitive data for AI training

India's Ministry of Electronics and Information Technology (MeitY) has put forward a draft framework meant to give AI developers access to some of the country's most sensitive datasets without exposing the people behind them. Secretary S Krishnan presented the "DEPA for AI Training" handbook at a roundtable in Bengaluru on October 30, 2026. The document was prepared with the iSPIRT Foundation, the volunteer think tank behind earlier digital public infrastructure work, Business Standard and ANI report.

How the framework would work

DEPA, short for Data Empowerment and Protection Architecture, already underpins consent-based sharing of individual financial data through India's Account Aggregator system. The training version targets something different: large volumes of de-identified data held by hospitals, banks and public agencies. According to Business Standard, it rests on four elements: a data exchange platform, machine-readable electronic contracts, a secure data environment and differential privacy.

Data holders would register datasets, and startups, researchers or companies would request access for a stated purpose. Training would run inside the secure environment, and developers would receive the trained model rather than raw records. Principal Scientific Adviser Ajay Kumar Sood summed up the idea as the model travelling to the data, ANI reports. Models would then face bias, security and explainability checks, with a competent authority able to certify them or suspend non-compliant activity.

Status and open questions

The handbook is a draft and carries no legal force. The roadmap begins with pilots in finance and healthcare alongside regulatory sandboxes, followed later by cross-border agreements and incentive schemes such as royalties or access fees for data providers. Elets CIO reports that consultations are expected in the coming weeks, but no formal comment period or deadline has been announced in the coverage reviewed.

Several issues are unresolved. Elets notes that the document does not say who is liable if data leaks from a secure environment, that payment models for data holders are still to be worked out, and that the handbook itself acknowledges anonymised data can often be re-identified. Binding rules would likely come from sectoral regulators.

Why it matters

Officials frame the plan as a way to turn India's data into usable AI training material while respecting privacy obligations under the country's data protection law. iSPIRT co-founder Sharad Sharma compared its significance to the 2016 launch of UPI, according to ANI. Whether hospitals and banks, which tend to be cautious, will actually share data through the system is the main test ahead.