India proposes secure AI training without handing developers the underlying data

India’s technology ministry has proposed letting AI developers train on protected local data without taking the underlying records away. Its Data Empowerment and Protection Architecture for AI Training, or DEPA, would put training inside secure environments governed by data providers’ rules. The aim is to build AI for Indian needs while preserving control over sensitive information.

The Ministry of Electronics and Information Technology, known as MeitY, outlined the framework in a document covered by The Register on November 2. The government’s rationale is that offshore model developers may lack the incentive to address India’s problems or keep data owners in control. Rather than simply seeking more training data, the proposal defines an intermediary through which developers would gain access under conditions set by the organizations supplying it.

The proposed system assigns three roles. Hospitals, banks and government agencies could act as Training Data Providers, sharing anonymized and encrypted data with a Data Exchange Platform. Model developers, called Training Data Consumers, would use data held at those platforms to train their systems. The exchange would enforce each provider’s usage rules, making it more than a place to find a dataset.

Those platforms would operate hardware-based Secure Data Environments. MeitY says the data would remain encrypted and isolated even while being processed. Developers would submit training work to a controlled environment near the data, rather than receive the records for use on their own infrastructure. The intended output is a trained model, not a copy of the underlying dataset.

the model travels to the data, rather than the data travelling to the model.

Professor Ajay Kumar Sood, Principal Scientific Adviser to the Government of India

The framework also addresses what a model might learn about an individual. It calls for systematic use of differential privacy, techniques intended to limit the learning or disclosure of individual-specific information. Shattered’s explanation describes adding carefully calibrated noise, which can reduce accuracy as privacy protection increases. The privacy settings, and who would choose them, remain unspecified in that account.

A separate safeguard would record every activity inside the secure environments in immutable audit logs—records designed not to be altered. That gives the proposal three distinct protections: hardware isolation for processing, privacy techniques governing what models learn, and a record for later scrutiny. These are features of the proposed design, not demonstrated results from an operating DEPA training service.

Three sectors MeitY wants to reach

• Health: The ministry wants to connect fragmented health data for AI-driven diagnostics, drug discovery and public-health management.
• Finance: MeitY says secure sharing of diverse financial data could potentially extend formal credit to 400 million underserved individuals and micro, small and medium-sized enterprises. That is an ambition, not a measured lending outcome.
• Education: The framework proposes overcoming gaps between data systems to support personalized learning and portable skill credentials. It points to India’s 250 million students as the population those efforts could serve.

The framework places this effort within India’s digital public infrastructure approach: government-backed shared tools intended to prevent large technology companies from dominating local markets. It also describes DEPA as a contribution to international efforts toward more inclusive and responsible AI. The proposal therefore has two stated audiences: developers building for Indian needs and institutions shaping how AI data access could work elsewhere.

India already operates several data exchanges, but the work needed to turn this AI-training architecture into an operating system remains unclear. DEPA is not yet a live training service. The immediate development is a proposed framework for controlled access, not a rollout that developers can already use.