The Ministry of Electronics and Information Technology has released a framework setting out how institutions holding data can make it available for training AI models, The Print reported. The handbook, titled "Data Empowerment and Protection Architecture (DEPA) for AI Training," was unveiled by MeitY Secretary S Krishnan at a roundtable in Bengaluru on October 31 and is open for public recommendations.
The framework defines three roles. Hospitals, banks, government agencies and other institutions are "Training Data Providers"; startups, researchers and companies are "Training Data Consumers"; and intermediaries called "Data Collabs" pool data from multiple sources for specific sectors. Principal Scientific Adviser Ajay K Sood described the approach as one where "the model travels to the data."
The handbook's most striking position concerns consent. DEPA's existing Account Aggregator system requires individual consent each time financial data is shared. For AI training, a section titled "Beyond Individual Consent" states that individual consent "is impractical at this scale," since the people whose data is used "may not interact directly with the training network." Their interests, it says, are protected through governance structures and technical safeguards. That sits in tension with Electronics and IT Minister Ashwini Vaishnaw's foreword, which describes DEPA as "a consent-based framework" ensuring "user-controlled data sharing."
On privacy, the handbook concedes that removing names and identifiers does not by itself prevent re-identification, and proposes two safeguards: secure data environments where models train without raw data being exposed to developers, and differential privacy, which adds statistical noise so individual records cannot be inferred. Agencies must de-identify personal data using pseudonymised keys before sharing. The handbook does not say whether DEPA will rely on the DPDP Act's research exemption, whose provisions take effect in May 2027.
Sector proposals are concrete: linking the Nikshay tuberculosis portal and e-Sanjeevani telemedicine data to build early warning systems for outbreaks; training credit models on aggregated GST filings and utility payments to lend to people without formal loan history; and building "skills passports" in education - where the handbook does not address the DPDP Act's parental-consent and child-tracking provisions. Oversight would involve a multi-stakeholder body and an unnamed "competent government authority" that could certify trained models as "fit for use" and suspend non-compliant activity. The roadmap proposes pilots in finance and healthcare, regulatory sandboxes and cross-border data agreements.
FundForge Insight: this handbook is India quietly choosing its side in AI's hardest trade-off - training data at scale versus individual consent - and choosing scale, with governance as the substitute. For startups, "Data Collabs" and certified secure environments could unlock datasets that today sit locked in hospitals and banks. For citizens, the safeguards that matter are the unnamed authority's teeth and whether "impractical" consent survives public consultation. Sources: The Print (November 4, 2026).
