MeitY launches DEPA handbook for sharing data to train AI

The Ministry of Electronics and Information Technology (MeitY) on Saturday, October 31, 2026, launched a handbook on the Data Empowerment and Protection Architecture (DEPA) for AI Training, a framework meant to let organisations share data for training artificial intelligence models while keeping control over it. The handbook was released by MeitY Secretary S. Krishnan at a roundtable in Bengaluru, with support from the iSPIRT Foundation, according to the government's official release. It sets out what the ministry calls a techno-legal framework for "purpose-bound" data collaboration: data can be used only for an agreed purpose, inside controlled computing environments, with privacy safeguards and records of where the data came from and how it was used.

AI models learn from data. The more varied and accurate the data, the better a model can perform, especially for Indian languages, local health conditions or regional farming patterns. But much of the most useful data sits with hospitals, banks, government departments and companies that cannot simply hand it over, because it includes personal or sensitive information and because sharing it could break privacy law or lose them control of a valuable asset.

DEPA for AI Training tries to solve this by changing how data is shared. Instead of copying a dataset and sending it to an AI developer, the framework is designed so that training happens inside a controlled environment where the data stays protected, its use is limited by contract to an agreed purpose, and every use is recorded. In the words of one person involved with the framework, quoted in reports, the model moves to the data rather than the data moving to the model. If it works as intended, a hospital could, for example, allow a model to learn from its records without the records ever leaving its control.

The framework is not free of criticism. Some commentators argue that it does not give enough weight to the consent of the individuals whose data is being used, and that it may sit uneasily with India's data protection law. Those questions are likely to shape how widely institutions are willing to adopt it, and how regulators view it.

Short-term: AI developers, research institutions and data-holding organisations now have a reference document setting out how such collaborations should be structured. Expect pilot projects and discussions with sectors such as health and finance.

Long-term: If adopted widely, the framework could help Indian AI developers access better local data while keeping privacy protections in place, improving models built for Indian needs. Its success will depend on trust, on legal clarity around consent, and on whether the technical safeguards hold up in practice.

Who is affected: AI developers and start-ups in India; hospitals, banks, government bodies and companies that hold large datasets; people whose personal data could be used for training; and policymakers working on AI and data protection.

Questions and Answers