In a March 2026 pilot, a bank and a fintech platform processed over 2 million cross-boundary queries in two weeks without exposing raw customer lists.
BENGALURU: The Ministry of Electronics and Information Technology on 31 October 2026 released the Handbook on Data Empowerment and Protection Architecture for AI Training. Prepared with the iSPIRT Foundation, it proposes that AI models travel into secure enclaves at data custodians rather than the reverse. Consequently, raw datasets would never leave the banks, hospitals and agencies that hold them. Union IT Secretary S. Krishnan presided over the launch at a stakeholder roundtable, with Principal Scientific Adviser Ajay Kumar Sood in attendance.
Why the data stays locked
The handbook opens with what it calls the Data Deadlock. India generates vast digital data across banking, healthcare, agriculture and logistics, yet much of it sits behind institutional walls. Custodians hesitate because sharing raw files carries risk. Penalties can reach ₹250 crore under Section 33 of the DPDP Act, 2023, and intellectual property can leak. Meanwhile, foreign models trained largely on Western internet data show cultural and linguistic bias in Indian settings. Furthermore, global platforms can strike exclusive data deals that smaller players cannot match. Economic projections in government reports suggest that resolving the deadlock could unlock up to $500 billion of AI-linked GDP by 2030.
A sealed room for training
DEPA Training replaces file transfers with hardware-isolated Secure Data Environments, also called Confidential Clean Rooms. Model developers submit training code, and the enclave runs it against the data. Notably, memory encryption at the silicon layer blocks cloud operators, administrators and developers alike from viewing the raw records. Only trained weight updates leave the enclave. Moreover, differential privacy adds calibrated noise during training, which guards against attempts to reconstruct individual records from a model. Datasets and outputs also carry cryptographic watermarks linked to an AI Provenance Chain, an immutable record of origins, consent terms, contracts and outputs. Providers can choose to anonymise data before ingestion or let the platform do so inside the enclave.
From inference to training
DEPA began in 2020 as a NITI Aayog governance layer of India Stack. Its first form, now called DEPA Inference, powers consented data flows through the Account Aggregator framework and the Ayushman Bharat Digital Mission. However, that design suits individual transactions, not bulk model training. The new handbook rests on six ADEPTS principles: accountability, democratisation, evolvability, privacy, transparency and security. Samyog, an iSPIRT-backed industry collective, will register participants, issue standard e-contracts, certify environments and settle disputes. Meanwhile, sectoral regulators such as the RBI will define data sensitivity, and the Data Protection Board of India will oversee compliance. Notably, the handbook ties into the IndiaAI Mission’s AI Kosh repository, so catalogued datasets can carry DEPA e-contracts.
Pilots and the DPDP link
Early pilots offer proof of concept. In March 2026 a commercial bank and a fintech platform evaluated credit card eligibility across a shared customer base. They processed over 2 million cross-boundary queries in two weeks without exposing raw customer lists. Likewise, a consortium of research hospitals helped a medical AI startup train an MRI-based tumour detection model. Its engineers never viewed the raw scans. Encouragingly, the design is structured to meet DPDP purpose limitation and data minimisation duties, because raw data stays inside the custodian’s perimeter. The handbook itself is non-binding. Public consultations begin in late 2026, and the DPDP enforcement rules are scheduled for May 2027.
Questions the handbook leaves open
Several practical gaps remain. However, the handbook sets technical standards but leaves pricing unstandardised, so data holders lack clear models for compensation. Liability, likewise, is unsettled. If a model trained in a compliant enclave later outputs biased or infringing material, responsibility among the provider, consumer, compute vendor and certifier is unclear. Similarly, hardware adds cost, since enclaves need TEE-capable GPUs such as the Nvidia H100 or H200, which may strain smaller firms and tier-2 institutions. Furthermore, trust rests on the enclave itself. A firmware flaw or misconfigured privacy parameter could expose data silently, and certification demands considerable audit capacity. Enterprise custodians may also wait for Data Protection Board guidance on whether in-enclave processing counts as a data transfer.
What to watch
Several indicators will show whether the framework moves from paper to practice. First, registrations of data providers and consumers with Samyog will measure market participation. Second, monthly in-enclave training jobs will test reliability at scale. Likewise, the number of Indian models trained on DEPA rails will show whether sovereign ambitions gain capacity. Furthermore, any security incident involving enclaves or contracts will test trust quickly.
For India, the handbook offers a distinct answer to a familiar problem. Where the United States leans on market deals and the European Union on after-the-fact enforcement, the handbook builds privacy into the compute itself. Encouragingly, it extends the digital public infrastructure approach behind the Account Aggregator framework into AI. Ultimately, its test will be whether banks and hospitals choose to open their enclaves to Indian model builders.
About the Author
