MeitY Proposes DEPA Framework for Privacy-Led AI Training Data

India's Ministry of Electronics and Information Technology (MeitY) has proposed a consent-based framework to make data sharing for AI model training easier. Called the Data Empowerment and Protection Architecture (DEPA) for AI training, it is meant to give startups, businesses and academic institutions access to large-scale, India-specific datasets while protecting citizens' privacy and complying with the DPDP Act.

The guidelines were drawn up with the think tank iSPIRT. They build on the existing DEPA framework, which already supports consent-based data sharing through initiatives such as Account Aggregator. The new architecture is techno-legal: organisations can collaborate on training without directly transferring the underlying datasets.

Four technical pillars

The framework rests on confidential clean rooms, secure environments where parties process data and train models without exposing datasets to each other; differential privacy, which prevents individual-level information from being extracted from aggregate data; electronic contracts, machine-readable agreements that define and enforce permitted uses and security requirements; and zero-trust security, where every access request is authenticated and authorised.

Three stakeholder groups are defined. Training Data Providers, such as banks, hospitals and government agencies, make data available. Training Data Consumers, including startups, enterprises, researchers and individuals, seek access. Data Collectives, or Data Collabs, are intermediaries that aggregate and standardise data and set governance rules.

How it would work

Providers would first anonymise and encrypt their datasets, register them on a data exchange and tag them with metadata and cryptographic identifiers. Consumers then request a dataset for a specific use case, and the electronic contract system checks the request against the sharing policies before granting access. Training takes place inside the secure environment using differential privacy, so raw data stays out of consumers' reach.

Trained models would face independent checks for bias, fairness, security, safety and explainability, and only those that pass would be approved for pilot deployment and scaling. Oversight would continue afterwards, with monitoring, periodic reviews and traceability of model outputs back to the data and contracts used.

The proposal follows draft guidelines from TRAI on responsible AI use in telecom, with stakeholder comments due by November 27. IT minister Ashwini Vaishnaw had also said the government would release a consultation paper on AI safety and security regulation within a month.