Government sets out rules for sharing data to train AI without handing it over

The Ministry of Electronics and Information Technology (MeitY) has published a handbook on using India's Data Empowerment and Protection Architecture (DEPA) to train artificial intelligence models. The aim is to let hospitals, banks, government departments and other institutions share data for AI training without giving up control of it.

MeitY Secretary S. Krishnan released the handbook on Saturday, October 31, at a roundtable in Bengaluru held with the iSPIRT Foundation, a technology think-tank, news agency ANI reported.

How it is meant to work

The framework combines four elements: contractual permissions that set out what the data may be used for; controlled computing environments in which training takes place; privacy-enhancing safeguards; and provenance tracking, which records where data came from, what permissions apply to it, and how it is used during training.

"Under DEPA, the model travels to the data, rather than the data travelling to the model."

That was how Ajay Kumar Sood, the Principal Scientific Adviser to the Government of India, described it at the launch, according to ANI. In practice, an AI developer would not receive a copy of, say, a hospital's patient records. Training would instead run inside an environment the data holder controls, under agreed terms. Sood said this could make it easier for several institutions, including ones in different countries, to collaborate.

Why it matters

Building AI systems for Indian languages, healthcare or agriculture needs large amounts of Indian data, much of it sensitive and held by institutions that are wary of sharing it. Krishnan said India's AI ambitions had to be matched by the ability to use data responsibly and securely.

The handbook also arrives as organisations adjust to India's Digital Personal Data Protection Act, 2023, which sets out how personal data may be collected and processed. DEPA was developed with iSPIRT and already underpins India's Account Aggregator system for sharing financial data with consent.

What happens next

The handbook is guidance, not a new law. Whether it is widely used will depend on data holders and AI developers adopting it, and on how it works alongside the data protection rules. The launch reports did not include a link to the handbook; we will add one once MeitY publishes it.