New Delhi: The Ministry of Electronics and Information Technology (MeitY) has released a framework that sets out how institutions holding data can make it available for training Artificial Intelligence (AI) models. The handbook, titled ‘Data Empowerment and Protection Architecture (DEPA) for AI Training’, was unveiled by MeitY Secretary S Krishnan at a roundtable in Bengaluru on 31 October.
The framework covers hospitals, banks, government agencies and other institutions, which it calls ‘Training Data Providers’. These can share datasets with startups, researchers and companies, called ‘Training Data Consumers’. Intermediaries called ‘Data Collabs’ will pool data from multiple sources for specific sectors.
At the launch, Krishnan said the framework would enable access to datasets for AI training while safeguarding privacy, commercial confidentiality and institutional control. Principal Scientific Adviser Ajay K Sood said that under DEPA, “the model travels to the data”.
However, the handbook—which has been opened up for recommendations from the public—makes a curious point about individual consent for people’s data being accessed for AI training.
On consent
The handbook distinguishes between AI “inference” and “training”. Inference is the use of an existing model on an individual’s data, such as assessing a loan application. Training is the building of a model from aggregate data. DEPA’s existing Account Aggregator system, which handles financial data, requires individual consent each time data is shared.
The Ministry of Electronics and Information Technology (MeitY), Government of India, convened a roundtable today to launch the DEPA for AI Training Handbook — a significant step towards enabling secure, trusted and responsible data sharing for AI training.#DigitalIndia pic.twitter.com/x7nIpSyXXu
— Ministry of Electronics & IT (@GoI_MeitY) October 30, 2026
For training, the handbook takes a different approach. In a section titled ‘Beyond Individual Consent’, it states that individual consent “is impractical at this scale”. It says ‘Data Principals’, the people to whom the data belongs, “may not interact directly with the training network”. Their interests, it says, are protected through governance structures and technical safeguards. It states that ‘Data Collabs’ “may be responsible for obtaining primary consent where applicable”.
In his foreword, Electronics and IT Minister Ashwini Vaishnaw describes DEPA as providing “a consent-based framework” that ensures “user-controlled data sharing”.
The Digital Personal Data Protection (DPDP) Act, 2023 exempts personal data processed for research or statistical purposes from most of its provisions, if the data is not used to make decisions about individuals and meets the standards set out in the DPDP Rules. These provisions take effect in May 2027. The handbook does not state whether DEPA would rely on this exemption.
On privacy safeguards
The handbook states that removing names and identifiers from datasets does not by itself prevent re-identification, as people can be identified by combining datasets. It proposes two additional safeguards. The first is “secure data environments”, in which AI models are trained without raw data being exposed to developers. The second is differential privacy, a technique that adds statistical noise so that individual records cannot be inferred from a model.
It sets out two options for data exchange platforms. Under the first, data providers anonymise data and ‘Training Data Consumers’ (startups, researchers and companies) may download it or use the secure environment. Under the second, the platform anonymises and encrypts the data and consumers work on it only within the secure environment.
Agencies are required to de-identify personal data before sharing it, using pseudonymised keys held by the originating agency.
What the handbook proposes sector-wise
In healthcare, the handbook proposes connecting data from the Nikshay portal, used to manage tuberculosis cases, and the e-Sanjeevani telemedicine platform to build early warning systems for disease outbreaks. It also proposes combining health data with geospatial data.
In finance, it proposes training credit models on aggregated, de-identified data such as GST filings and utility payments to extend credit to individuals and small businesses without a formal loan history.
In education, it proposes training adaptive learning systems on learner performance data and building “skills passports” linked to the Academic Bank of Credits. Under the DPDP Act, processing a child’s data requires verifiable parental consent, and tracking or behavioural monitoring of children is barred, with exemptions for educational institutions under the Rules. The handbook does not address how these provisions would apply.
Incentives and oversight
The handbook describes ‘Data Collabs’ as commercial entities. Its roadmap proposes “royalty or access-fee models” for data providers, and states that hospitals sharing data could get “priority use” of resulting models.
On oversight, the forewords by Krishnan and Sood refer to governance led by self-regulatory organisations. The main text proposes a multi-stakeholder body of data providers, developers, technology firms, domain experts and civil society. It also states that a “competent government authority” would certify trained models as “fit for use” and could suspend or revoke non-compliant activities. The handbook does not name the authority.
The roadmap proposes pilots in finance and healthcare, regulatory sandboxes, cross-border data agreements and capacity-building programmes.
(Edited by Gitanjali Das)
Also Read: Anthropic study’s new AI cautionary tale: AI agents can influence expert opinion to serve bias