Yesterday we wrote about the new robots.txt line that lets websites say no to AI training. That was about keeping your content out of AI models. India's IT ministry has now published the other half of the story: a framework for sharing data with AI developers safely, when you want to. If your business holds valuable data, or wants to build AI on someone else's data, this handbook is worth ten minutes of your time. Here is what it says, in plain words. Every fact is linked.
1. What was launched on October 31
The Ministry of Electronics and Information Technology (MeitY) launched the Handbook on Data Empowerment and Protection Architecture (DEPA) for AI Training on Saturday, October 31, 2026, at a roundtable in Bengaluru, according to reports by PTI (via Business Standard) and ANI.
- It was unveiled by S Krishnan, Secretary, MeitY, and developed with support from the iSPIRT Foundation (PTI).
- The official release, as quoted by PTI, says the framework "combines contractual permissions, controlled computing environments and privacy-enhancing safeguards" and adds data provenance, so the "origin, permissions and use of data" can be traced through training.
- Krishnan said: "India's AI ambitions must be matched by the ability to use data responsibly and securely," and that MeitY is committed to taking the framework forward (ETV Bharat).
The roundtable brought together people from government, industry, academia and research, The Hindu BusinessLine reports (ANI copy).
2. The big idea: the model travels to the data
Today, if a startup wants to train an AI model on, say, hospital scans or bank transactions, the usual route is to get a copy of the data. Most data holders say no, because of privacy, confidentiality and legal risk. MeitY's release names exactly these worries ("privacy, confidentiality, intellectual property and institutional control") as the reasons data sharing stalls (ETV Bharat). The handbook calls this the "Data Deadlock" (MeitY handbook).
DEPA flips the direction. Principal Scientific Adviser Ajay Kumar Sood summed it up at the launch: "Under DEPA, the model travels to the data, rather than the data travelling to the model." He said this enables "trusted, multi-party and cross-border data collaboration" (ETEnterpriseAI, ANI).
In other words, the data owner keeps the data. The AI developer sends its model, or its training job, into a locked environment, and gets back a trained model, not the raw records.
3. How DEPA for AI Training works
The handbook PDF on MeitY's website describes two main roles and four technical building blocks.
- Training Data Providers (TDPs): institutions that hold valuable data. The handbook's examples are hospitals, banks and public agencies.
- Training Data Consumers (TDCs): the people who build AI, which the handbook lists as startups, researchers and enterprises.
The building blocks are:
- Data Exchange Platform: where datasets are listed and requested. The handbook says it can also offer anonymisation, encryption and even GPU infrastructure "as a service".
- Secure Data Environment: a "neutral and secure environment for computations", so the provider's raw data stays protected and is not exposed to the AI developer.
- Electronic contracts: machine-readable agreements that state what the data may be used for, and are enforced by the system, not just on paper.
- Differential privacy: a mathematical technique that lets a model learn overall patterns while making it, in the handbook's words, "practically impossible to re-identify any individual data point". Training runs within an allocated "privacy budget".
The handbook offers two options. In the first, the data provider anonymises the data before it reaches the platform. In the second, the platform's secure environment handles anonymisation and encryption of the raw data itself. It also proposes an oversight body to set privacy, ethics and security standards, register eligible participants, oversee the data-sharing process and handle disputes, aligned with the IT Act, 2000 and the DPDP Act, 2023.
4. Who it could help
The handbook points to healthcare, financial services, education, agriculture and geospatial data as areas where India's data is spread across many walls. It also says the framework works alongside national data platforms such as AI Kosh, API Setu and Open Government Data (MeitY handbook).
- AI startups and researchers could get access to large, India-specific datasets they could never buy or copy outright.
- Data holders such as hospitals, lenders, insurers and large companies could let others build on their data while keeping control, with a contract and an audit trail.
- Everyone else could get AI tools that understand Indian conditions better. The handbook warns that AI trained on "limited, foreign datasets" can carry biases.
The people behind it are thinking big. iSPIRT co-founder Sharad Sharma compared the launch's importance to the announcement of UPI in February 2016, and Infosys co-founder Kris Gopalakrishnan said it could help researchers reach diverse datasets while protecting the rights of data custodians (ANI).
5. What it is not (yet)
It helps to be clear about what changed on October 31 and what did not.
- It is a handbook, not a law. The document on MeitY's site is marked "Draft for Discussion" and calls itself "a living resource that evolves alongside the DEPA framework", inviting "actionable recommendations" (MeitY handbook).
- The full system is still being built. The oversight body is a proposal in the handbook. A case study by the Digital Impact Alliance, published in May 2026, described DEPA for Training as being "in the pilot stage, led by iSPIRT".
- Your DPDP duties do not change. The handbook says DEPA is meant to align with the DPDP Act, 2023. Any personal data you share still needs a proper legal basis.
6. What Indian businesses can do now
- Know what data you hold. Make a simple list: customer records, transactions, images, sensor or machine data. Mark what is personal, what is confidential and what could be shared in aggregate.
- Do not rely on "anonymised" alone. The handbook warns that traditional anonymisation is "increasingly insufficient". If you share data for AI today, prefer setups where the raw data never leaves your control.
- If you build AI, plan for "model-to-data". Write your training code so it can run inside someone else's secure environment. That makes you a much easier partner for a hospital or a bank.
- Put purpose in writing. Whatever the platform, agree in a contract what the data may be used for, for how long, and what you get back.
- Read the handbook and give feedback. MeitY says it welcomes recommendations. Industry bodies and startups that respond early can shape the rules.
7. The bottom line
India built UPI so that money could move safely between banks. DEPA for AI Training tries to do something similar for data used in AI: let it be used without being handed over. It is early, and much depends on how the platforms and the oversight body are built. But the direction is clear, and businesses that sort out their data now will be ready when the doors open. For the opposite case, keeping your website content out of AI training, read our guide to the shared robots.txt opt-out.
FAQ
What is DEPA for AI Training?
It is a framework from India's IT ministry, MeitY, for sharing data to train AI models while protecting privacy and control. The handbook was launched on October 31, 2026, in Bengaluru, with support from the iSPIRT Foundation.
What does "the model travels to the data" mean?
Instead of copying data to the AI developer, the developer's model is trained inside a secure environment where the data stays. The data owner keeps the raw data, and the developer gets back a trained model.
Is DEPA for AI Training mandatory?
No. The handbook is a framework, not a law. The version on MeitY's website is marked "Draft for Discussion" and MeitY invites recommendations on it.
Who can use it?
The handbook describes Training Data Providers, such as hospitals, banks and public agencies, and Training Data Consumers, such as startups, researchers and enterprises. Registration of participants is one of the jobs of a proposed oversight body.
Does it replace the DPDP Act?
No. The handbook says DEPA for Training is meant to align with the IT Act, 2000 and the DPDP Act, 2023. Your existing data protection duties still apply.
Sources
- MeitY: Data Empowerment and Protection Architecture (DEPA) for AI Training, handbook PDF (Draft for Discussion)
- Business Standard (PTI): MeitY launches DEPA handbook to enable secure data sharing for AI training (Oct 31, 2026)
- ANI: MeitY launches DEPA handbook to enable secure data sharing for AI training (Oct 31, 2026)
- The Hindu BusinessLine (ANI): MeitY launches DEPA handbook to enable secure data sharing for AI training (Oct 31, 2026)
- ETEnterpriseAI (The Economic Times): MeitY launches DEPA framework to enable trusted data sharing for AI training (Oct 31, 2026)
- ETV Bharat: Govt launches handbook on Data Empowerment and Protection Architecture for AI training (Oct 31, 2026)
- Digital Impact Alliance: DEPA for Training: A secure, consent-based environment for AI training (May 6, 2026)
Details of the framework (roles, building blocks, the two anonymisation options and the proposed oversight body) are from the handbook PDF on MeitY's website, checked on November 1, 2026; it is marked as a draft for discussion and may change. Quotes from the launch are as reported by PTI, ANI, ETV Bharat and ETEnterpriseAI. This article is general information, not legal advice. The cover image is our own illustration.