DEPA Handbook for AI Training: A Framework for Trusted Data Sharing

News context: 31 October 2026 | Published: 3 November 2026

Mains: GS-III: Science and Technology – Artificial Intelligence, data governance, digital public infrastructure.

Prelims: DEPA, MeitY, iSPIRT, Account Aggregator, DPDP Act 2023, NITI Aayog.

Why in the News

The Ministry of Electronics and Information Technology (MeitY) released the Data Empowerment and Protection Architecture (DEPA) Handbook for AI Training at a high-level roundtable held in Bengaluru on 31 October 2026. The handbook was unveiled by the ministry's Secretary, S. Krishnan, with the collaboration of the iSPIRT Foundation. The roundtable brought together representatives of government, industry, technology, academia, research and the media.

Background of DEPA

The DEPA concept is not new. In 2020, NITI Aayog presented a detailed blueprint of the Data Empowerment and Protection Architecture, centred on consent-based data sharing. In the financial sector, this idea led to the Account Aggregator system, under which a customer's financial data does not move from one institution to another without consent. This same tradition of Indian digital public infrastructure — as in UPI payments and Aadhaar identity — has now reached the use of data in the AI era. At the launch, iSPIRT co-founder Sharad Sharma called it the most significant moment since the announcement of UPI in February 2016.

On the legal side, this framework is a further step in the direction of the Digital Personal Data Protection Act, 2023 (DPDP Act), in which consent, purpose limitation and data rights are the central principles.

Key Components of the Handbook

According to the ministry's announcement, the DEPA Training framework combines these elements:

• Purpose-bound collaboration: data is used only for the specified purpose (such as training a model).
• Contractual permissions: the terms of data sharing are bound in a contract, keeping rights and obligations clear.
• Controlled computing environment: computation takes place in a secure, controlled environment, so that data does not move around in the open.
• Privacy-enhancing safeguards: technology-level protection so that personal or sensitive information is not exposed.
• Data provenance: the origin of the data, the permissions given over it and its use in the training process can all be traced through the entire process.

The Principal Scientific Adviser to the Government of India, Prof. Ajay Kumar Sood, summed it up this way: "In DEPA, the model goes to the data; the data does not go to the model." That is, the data stays in its secure location and the training process reaches it there. He described it as a means of multi-stakeholder and cross-border scientific collaboration and "India's contribution to global science diplomacy".

Why It Matters

AI models need diverse, high-quality data, but institutions hesitate to share data because of concerns over privacy, commercial confidentiality, intellectual property and institutional control. DEPA Training claims to resolve this impasse — large datasets open up for AI training while privacy and control are preserved. Its use has already been tested in the banking sector: HDFC Bank's digital banking head described the potential of "DEPA Training" as meaningful, referring to the experience of "DEPA Inference". Infosys co-founder Kris Gopalakrishnan said that secure data access could let India lead in "safe AI".

Challenges and Way Forward

• Implementation: the handbook is a guide; its standards, certification and enforcement mechanisms are yet to be built.
• Alignment with the DPDP Act: as the rules under the 2023 Act come into force, DEPA's contractual terms will have to be aligned with them.
• Institutional participation: the framework's success will depend on whether government and private institutions actually contribute their datasets to it.
• Cross-border data: in international collaboration, balancing Indian data sovereignty with foreign laws will remain a complex question.

Mains Practice Question

"Without large-scale data sharing, the development of AI remains limited, but uncontrolled sharing is a threat to privacy and sovereignty." In the light of this statement, evaluate the role of techno-legal frameworks such as DEPA. (Answer in 250 words. 15 marks)

Answer Outline

Introduction: Refer to the DEPA for AI Training handbook released by MeitY on 31 October 2026; set out the tension between the need for quality data for AI development and privacy concerns.

Main Body: In favour: access to diverse datasets, multi-institutional and cross-border research, faster scientific discovery. Risks: privacy, commercial confidentiality, intellectual property and data sovereignty. DEPA's measures: purpose-bound use, contractual permissions, controlled computing environments, privacy-enhancing safeguards and data provenance; the principle that "the model goes to the data". Show continuity with the DPDP Act 2023 and the Account Aggregator tradition going back to NITI Aayog 2020. Among challenges, cover implementation standards, enforcement, institutional participation and cross-border data rules.

Conclusion: A techno-legal framework can balance both goals, provided standards, certification and participation are ensured — this is the next link in India's digital public infrastructure.

Prelims Practice Questions

4 November 2026 Update: "Individual Consent Impractical" — Privacy Debate Intensifies

According to a review by ThePrint (4 November 2026), the handbook distinguishes between AI inference (applying an existing model to a person's data) and training (building a model from aggregated data): in the Account Aggregator system, individual consent is mandatory for every share, but for training the 'Beyond Individual Consent' section says individual consent at this scale is "impractical" — data principals are unlikely to connect directly with training networks; their interests would be protected by "governance structures and technical safeguards", and Data Collabs would take "primary consent where applicable". The handbook does not clarify whether it will rely on the DPDP Act's research exemption (exemption from most provisions when no person-specific decision is made; rules effective from May 2027).

On privacy protection, the handbook accepts that de-identification is not enough by itself — combining datasets makes re-identification possible. Two proposed remedies: secure data environments (training without the raw data being visible to the developer — "the model goes to the data") and differential privacy (statistical noise). Sectoral proposals: disease alerts from Nikshay/e-Sanjeevani, credit models based on GST/utility payments, and a "Skills Passport" (linked to ABC) — but how the DPDP provisions on children's data will apply remains an open question. For oversight, a multi-stakeholder body and an unnamed "empowered government authority" (which would certify models as "fit for use") are proposed; the roadmap includes pilots in finance and health, regulatory sandboxes and cross-border data agreements.

Sources

1. Press Information Bureau: launch of the DEPA Handbook for AI Training, 31 October 2026
2. NITI Aayog: DEPA concept book, 2020
3. Report on the key points of the DEPA Handbook, November 2026
4. ThePrint: privacy review of the DEPA Handbook, 4 November 2026

Download This Article: PDF