India has some of the richest datasets in the world, from hospital scans to bank transaction histories, but almost none of it reaches the teams building AI models. Hospitals and banks rarely share it: they earn little from doing so and face penalties of up to ₹250 crore under the data protection law if it leaks. The Ministry of Electronics and Information Technology (MeitY) now wants to break that stalemate by sending AI models to the data instead of sending data to the developers.

MeitY Secretary S Krishnan unveiled the Data Empowerment and Protection Architecture (DEPA) for AI Training handbook at a roundtable in Bengaluru on 30 October. The draft framework, prepared with the volunteer-led think tank iSPIRT Foundation, is pitched as India’s digital public infrastructure for AI, and says it has the potential to unlock $500 billion in AI-driven value for India’s GDP by 2030.

Breaking the “data deadlock”

The handbook calls the core problem a “data deadlock”: the data needed to solve the next generation of problems is split across domains and locked behind separate institutional and regulatory walls. It argues that simply stripping out names and ID numbers is not enough, because anonymised data can often be re-identified and loses much of its usefulness along the way.

DEPA itself is not new. NITI Aayog introduced it in 2020 as a way for citizens to share their own data with consent, and that model already powers the Account Aggregator system in finance. The new DEPA Training layer tackles a different problem: bulk, de-identified data used to build models in the first place.

How the “sealed room” works

The framework rests on four technical pillars: a Data Exchange Platform, machine-readable electronic contracts, a Secure Data Environment and differential privacy.

• Data providers such as hospitals, banks and public agencies register their datasets.
• Data consumers, including startups, researchers and enterprises, request access for a specific use case.
• Data Collabs, a new class of intermediaries, aggregate and standardise data from multiple sources.
• Training runs inside a secure computing environment, a “sealed room”, that executes only what the authorised electronic contract permits. The developer sends in a model and gets back only the trained model, or in some cases just a decision, such as on a loan application.

Personal and sensitive data would never be shared in raw form, and trained models would face bias, security and explainability checks before deployment, under guidelines from a competent government authority. “In this model, compliance is not a barrier to innovation; it is the feature that unlocks it,” the handbook says.

Early pilots in banking and healthcare

Pilots were demonstrated at the launch. In one, a bank that has been testing the approach since March identified which customers of a fintech partner qualified for its credit cards before seeking consent, then approached only those with a genuine offer; the pilot handled more than two million requests in two weeks, according to Mint. In another, hospitals and a health-tech startup are training a tumour-detection model on MRI scans that the startup never sees.

The sector stakes are large. The handbook sizes India’s financial services landscape at $550 billion and says the framework could help extend formal credit to 400 million underserved individuals and MSMEs, against a ₹20–25 trillion MSME credit gap. It describes a $600 billion-plus healthcare market and points to 250 million students in education.

Principal Scientific Adviser Prof Ajay Kumar Sood, Infosys co-founder Kris Gopalakrishnan, iSPIRT co-founder Sharad Sharma, and representatives of HDFC Bank, Sarvam and Emergent AI took part in the Bengaluru roundtable.

What comes next

The framework is a draft and is not legally binding. Consultations are expected to begin in the coming weeks, and the roadmap starts with pilots in finance and healthcare alongside regulatory sandboxes, followed by cross-border agreements, capacity building and incentive models such as royalties or access fees for data providers. Day-to-day management is expected to sit with Samyog, a new industry group powered by iSPIRT, which will register participants, provide standard contracts and handle disputes.

Open questions remain. The handbook says payment methods for data owners “will be explored” and does not spell out who is liable if data leaks from a sealed room. Observers expect binding rules to come from sectoral regulators rather than a new law, much as the Account Aggregator framework did. The timing also matters: the main rules of the Digital Personal Data Protection Act, 2023 take effect in May 2027, and the government is separately weighing dedicated AI legislation.

Why it matters for CIOs

For technology leaders at banks, hospitals and large enterprises, DEPA Training offers a possible route to monetise or collaborate on data without handing it over, while giving AI startups access to the domain data they need to build models for Indian use cases. The catch is trust: success will depend on whether secure environments, contracts and certification hold up well enough to convince risk-averse institutions to take part.

Sources: Business Standard; Mint; MeitY / iSPIRT DEPA for AI Training handbook.

Be a part of Elets Collaborative Initiatives. Join Us for Upcoming Events and explore business opportunities. Like us on Facebook , connect with us on LinkedIn and follow us on Twitter.

"Exciting news! Elets technomedia is now on WhatsApp Channels Subscribe today by clicking the link and stay updated with the latest insights!" Click here!