India Publishes DEPA Handbook to Let AI Train on Data Left in Place

India’s IT ministry has launched a handbook on DEPA AI training, a framework meant to let developers train models on sensitive data that never leaves the bank, hospital or agency holding it. The Ministry of Electronics and Information Technology (MeitY) unveiled the Handbook on Data Empowerment and Protection Architecture (DEPA) for AI Training at a roundtable in Bengaluru, with support from the iSPIRT Foundation.

The ministry said on X on Friday 30 October that it had “convened a roundtable today to launch the DEPA for AI Training Handbook”, and the government’s Press Information Bureau published its release on Saturday morning. What it describes is a handbook, not a law. Mint reported that the framework is not legally binding and that officials did not say if or when it might be, and the government gave no figures for who will use it or dates for when.

How DEPA AI training is meant to work

The problem the handbook targets is a familiar one. Valuable data for AI sits with institutions that cannot simply hand it over because of “privacy, confidentiality, intellectual property and institutional control”, the PIB release says. DEPA Training answers that with what the government calls a “techno-legal framework” for “purpose-bound data collaboration”, under which institutions keep control of their data.

According to the release, the framework “combines contractual permissions, controlled computing environments and privacy-enhancing safeguards”. It also builds in data provenance, so that “the origin, permissions and use of data” can be traced through training. Ajay Kumar Sood, the government’s Principal Scientific Adviser, put the idea in one line: “Under DEPA, the model travels to the data, rather than the data travelling to the model.”

Business Standard reported that the handbook, which it called a draft framework, rests on four technical pillars: a data exchange platform, electronic contracts, a secure data environment and differential privacy. It said the roadmap starts with pilots in finance and healthcare, with regulatory sandboxes alongside, and that the document claims the approach could unlock $500 billion in AI-driven value for India’s GDP by 2030. The PIB release does not repeat those details, and TSN has not seen the handbook itself.

Officials pitch it as trusted data sharing at scale

S. Krishnan, MeitY’s Secretary, said: “The DEPA Training Framework enables trusted data collaboration at scale, unlocking access to large-scale datasets for AI training while safeguarding privacy, commercial confidentiality and institutional control.” He added that MeitY “is fully committed to taking this framework forward”.

Sood said the approach enables “trusted, multi-party and cross-border data collaboration” and described DEPA as “India’s contribution to global science diplomacy”. Sharad Sharma, co-founder of iSPIRT, went further. In his view, “This is easily a more significant moment since February 2016, when the Unified Payment Interface (UPI) was announced.” That is his comparison; the handbook has no users yet against which to test it.

Industry voices were more measured. Anjani Rathor, who heads digital banking and customer experience at HDFC Bank, said “our experience with DEPA Inference has demonstrated the promise of secure data collaboration”, and that the bank sees an opportunity to build on it through DEPA Training.

An extension of India’s consent-based data system

DEPA itself is not new. iSPIRT’s DEPA documentation says it was proposed in 2016 to let people share their data between providers and services under “fine-grained and timely consent”. That consent is purpose-limited, the same page notes, so data shared to deliver one service “cannot be used or shared for other purposes such as analytics or training models”. The training framework is meant to fill that gap.

It also lands in a busy month for AI rules in India. The telecom regulator TRAI has just proposed responsible AI rules for operators, still at the consultation stage, and the cybersecurity agency CERT-In warned that AI agents under test went beyond their authorised tasks and reached Indian organisations’ live systems. On the data side, NVIDIA and AI4Bharat have described a 2.8-trillion-token pretraining corpus in 22 Indian languages.

The hard part is liability, not the architecture

The handbook’s central promise, that a model can learn from data nobody else gets to see, solves a technical problem. Whether institutions take it up depends on a legal one. A bank or hospital that lets an outside model train on its records is still the party answerable to its customers and its regulator if something goes wrong, and a handbook cannot shift that responsibility. Until a regulator says in writing what a data holder may do under DEPA, and who is liable if a secure environment fails, compliance teams will treat participation as a risk to be signed off, not an opportunity to be seized.

That is why the absence of numbers matters. Neither MeitY nor iSPIRT has named the institutions that will take part, how many datasets will be offered, or when any pilot will begin. HDFC Bank’s interest rests on its experience of the consent-based inference cycle, which is a narrower task than letting outside models train on bulk data.

The contrast with the shared AI training opt-out that Google, OpenAI and Microsoft backed this week is instructive. That signal is about letting data owners say no. DEPA is about giving them a safe way to say yes. For compliance teams in UK and other firms with Indian operations, the next step to watch is whether sectoral regulators adopt it, because that is where binding duties would come from.

Sources

• PIB (Ministry of Electronics & IT): MeitY Launches DEPA for AI Training Handbook to Advance Trusted Data Collaboration for AI (31 Oct 2026)
• MeitY on X: roundtable to launch the DEPA for AI Training Handbook (30 Oct 2026)
• DEPA World (iSPIRT): Data Sharing in DEPA
• Mint: India pilots data grid to train AI on sensitive info without seeing it
• Business Standard: India proposes framework to unlock data for AI training, protect privacy (30 Oct 2026)

Related stories

• India’s Telecom Regulator Proposes Responsible AI Rules for Operators
• NVIDIA and AI4Bharat Detail a 2.8-Trillion-Token Indic Pretraining Corpus, Releasing Soon
• India’s CERT-In Says AI Agents Under Test Exceeded Their Task Authorisation and Reached Indian Organisations’ Live Systems
• Google, OpenAI and Microsoft Back a Shared AI Training Opt-Out