New handbook lets AI learn without data leaving its owner

DEPA for AI training: what happened?

A hospital may have lakhs of X-rays that could train an AI to spot disease, but it cannot simply hand them over. DEPA tries to let the AI learn while the hospital keeps control.

• The Ministry of Electronics and Information Technology released the Handbook on Data Empowerment and Protection Architecture (DEPA) for AI Training at a roundtable in Bengaluru.
• It was released by Electronics and IT Secretary S. Krishnan, with support from the iSPIRT Foundation.
• The problem it tackles: worries over privacy, confidentiality, intellectual property and control stop data sharing.
• The fix: a techno-legal framework for purpose-bound data sharing, where institutions keep control of their data.
• Under it, the AI model is sent to the data, so the data never leaves its owner.

What is DEPA?

DEPA is an Indian design for sharing data only with the person’s or institution’s consent, and only for a stated purpose.

It is the idea behind the Account Aggregator system, regulated by the Reserve Bank of India, which lets people share their financial data between banks and lenders with consent.

DEPA Training extends this to AI. Instead of collecting all data in one place, the model is trained inside a secure environment where the data sits, and only the trained model comes out.

The Digital Personal Data Protection Act, 2023 requires consent and purpose limits for using personal data, which makes such safe designs more important.

Which laws and Articles apply?

• Article 21: right to privacy (K.S. Puttaswamy, 2017).
• Digital Personal Data Protection Act, 2023: consent and purpose limits.
• Information Technology Act, 2000.
• IndiaAI Mission (2024): building AI capacity, including datasets.

Why does DEPA for AI training matter?

What are the problems with DEPA for AI training?

• Secure computing environments are costly and technical.
• Smaller institutions may lack the skills to use DEPA.
• Trained models can sometimes leak information about the data.
• Rules for who is liable if something goes wrong are not clear.

What should be done next on DEPA for AI training?

• Offer shared secure computing for small institutions.
• Test DEPA in health and agriculture first.
• Set audit standards for privacy in AI models.
• Align DEPA with the rules under the DPDP Act.

What can Prelims ask on DEPA for AI training?

Prelims probability: Expect a question on DEPA: a consent-based data-sharing design behind the Account Aggregator system; under DEPA Training the AI model goes to the data.

• DEPA: Data Empowerment and Protection Architecture; consent-based data sharing.
• Account Aggregator: built on DEPA; regulated by RBI.
• DEPA Training: the AI model goes to the data.
• Digital Personal Data Protection Act, 2023.
• Right to privacy: Puttaswamy judgment, 2017.

How to write about DEPA for AI training in Mains

Practice question (15 marks, 250 words): How can India use data to build AI while protecting privacy? Discuss with reference to DEPA for AI Training.

• Intro: MeitY handbook; model goes to data.
• Why data sharing is hard: privacy, IP, control.
• DEPA, Account Aggregator, DPDP Act.
• Challenges: cost, skills, leakage.
• Conclusion: privacy-first AI as digital public infrastructure.