The Historic Announcement (31 Oct 2026, Bengaluru)
At a high-level roundtable in Bengaluru convened by the Ministry of Electronics and Information Technology (MeitY) with support from the iSPIRT Foundation, Shri S. Krishnan (Secretary, MeitY) formally launched the Handbook on Data Empowerment and Protection Architecture (DEPA) for AI Training. The roundtable convened key architects of India’s digital economy including Prof. Ajay Kumar Sood (Principal Scientific Adviser to GoI), Sharad Sharma (Co-founder, iSPIRT), Anjani Rathor (Group Head, HDFC Bank), Kris Gopalakrishnan (Co-founder, Infosys), Sarvam AI, and Emergent AI.
For the past three years, the generative AI boom has collided violently with statutory data protection regimes. Global foundational models have operated primarily on a data-extraction paradigm: web-scraping proprietary content, ingesting corporate repositories into centralized cloud buckets, and pooling sensitive personal records without purpose-bound technical isolation.
In India, under the strict penalties of the Digital Personal Data Protection Act (DPDPA 2023)—which imposes fines up to ₹250 Crore per incident under Section 33 for failure to observe reasonable security safeguards—such data centralization creates unacceptable legal, commercial, and national security liabilities.
The launch of the DEPA for AI Training Handbook changes this landscape completely. As iSPIRT co-founder Sharad Sharma remarked at the launch:
1. The Core Paradigm Shift: "The Model Travels to the Data"
The fundamental premise of DEPA for AI Training was captured concisely by Prof. Ajay Kumar Sood, Principal Scientific Adviser to the Government of India:
To understand why this is a foundational engineering revolution, compare how traditional machine learning training pipelines work against the DEPA Model-to-Data paradigm:
Data Moves to Model
- Egress & Exfiltration: Data custodians copy and upload terabytes of raw records into third-party AI vendor clouds (AWS US-East, Azure West).
- Custody Loss: Once data leaves the enterprise VPC, the data fiduciary loses control over derivative uses, retention periods, and internal inspection.
- DPDPA Liability: Violates Section 6 purpose limitation; any downstream breach exposes the original data fiduciary to ₹250 Cr statutory penalties under Section 8(6).
- IP Leakage: Trade secrets, medical records, and core banking CBS logs are exposed to AI model engineers during data staging.
Model Travels to Data
- Zero Data Movement: Raw datasets never leave the data custodian's sovereign boundary, on-premise datacenter, or secure VPC.
- Ephemeral Compute Enclaves: Untrained model weights enter a cryptographically isolated confidential sandbox located inside or adjacent to the custodian's perimeter.
- Gradient Extraction Only: Only mathematical parameter updates (gradients) exit the enclave. Raw records are never copied or persisted outside.
- DPDPA Native: Satisfies Section 4 purpose specification, Section 8(5) technical safeguards, and integrates with DEPA electronic consent artifacts.
2. Deep-Dive: What is "Blind Data Architecture"?
At the heart of the DEPA Training Framework is what privacy engineers term Blind Data Architecture.
In a Blind Data Architecture, an AI model trains, fine-tunes, or evaluates on sensitive institutional and citizen data without the model developer, host cloud provider, AI researchers, or any human operator ever observing, copying, or reconstructing the underlying plaintext data points.
Sovereign Data Custodian Storage (Zero Egress)
Enterprise data lakes (PostgreSQL, Cassandra, S3 Glacier) hold PII, medical diagnostics, or UPI transaction streams. Data remains encrypted at rest inside Indian cloud regions (AWS Mumbai, GCP Delhi, Azure Pune) or on-premise hardware.
DEPA Techno-Legal Contract & Consent Attestation
The Model Developer requests specific training parameters via machine-readable DEPA contracts. Machine-verifiable consent tokens (conforming to DPDPA Section 6) validate purpose, time bounds, and domain scope before execution permissions are granted.
Hardware Enclave / Confidential VM (TEE) Execution
An ephemeral Trusted Execution Environment (e.g. AMD SEV-SNP, Intel TDX, AWS Nitro Enclaves) boots within the perimeter. Model code and weights are injected into enclave memory. Enclave memory is cryptographically sealed from hypervisors and root administrators.
Blind Training with Differential Privacy Injection
Backpropagation computes gradient updates. Calibrated mathematical noise (ε, δ-differential privacy) is added to gradients to mathematically guarantee that individual citizen records cannot be reversed via Model Inversion attacks.
Cryptographic Attestation & Model Output
The ephemeral enclave destroys all intermediate in-memory data buffers upon epoch completion. Only updated model weights and tamper-evident audit proofs (signed by the hardware security module) exit to the model developer.
3. The Four Technical Pillars of Blind Data Engineering
Executing a true Blind Data Architecture requires combining four distinct engineering disciplines into a cohesive, automated pipeline:
1. Confidential Computing & TEEs
Hardware-based Trusted Execution Environments (TEEs) isolate training computations in encrypted memory slices. Even system administrators with root access or cloud hypervisor engineers cannot inspect or dump enclave RAM.
2. Cryptographic Data Provenance
Every data partition ingested into the enclave carries a cryptographic provenance token. If a Data Principal revokes consent under DPDPA Section 6(4), the token identifies the affected batch for targeted unlearning or key-shredding.
3. Differential Privacy (ε, δ)
Preventing "membership inference" and "model inversion" attacks where an adversary queries a completed model to reconstruct sensitive training data. Calibrated noise injection ensures privacy guarantees are mathematically provable.
4. Clean Room Contract Ledgers
Statutory audit logs record exact model hashes, training run times, dataset checksums, and enclave verification receipts. These court-admissible dossiers prove full compliance to the Data Protection Board of India (DPBI).
4. Banking & BFSI: From DEPA Inference to DEPA Training
India's financial institutions have already pioneered decentralized data verification through DEPA Inference (the Account Aggregator ecosystem). As Anjani Rathor, Group Head of Digital Banking & Customer Experience at HDFC Bank, noted during the MeitY launch:
Under DEPA Inference, an institution asks a binary or aggregated question (e.g., "Has this applicant maintained an average quarterly balance exceeding ₹50,000?"). The Account Aggregator executes the logic at the source bank and returns an answer without transferring bank statements.
DEPA Training takes this to multi-party federated model development:
- Multiple commercial banks can collaboratively train an industry-wide credit underwriting or fraud detection AI model.
- No bank ever shares customer transaction histories, account numbers, or PANs with competitor institutions.
- Each bank runs the training iteration inside its sovereign perimeter on its local data slice, sending back only anonymized parameter updates.
5. Statutory Mapping: DEPA Training & DPDPA 2023
The DEPA Training Framework is not merely a technical architecture; it is directly mapped to the statutory compliance obligations established by India's privacy laws:
| DPDPA Provision | Traditional AI Risk | DEPA Blind Data Solution |
|---|---|---|
| Section 4(1)(a) & Section 6 Purpose Limitation & Consent |
Data collected for customer onboarding is repurposed for AI training without explicit, itemized, affirmative consent notices. | DEPA machine-readable data agreements enforce cryptographic purpose binding. Training fails automatically if consent token is absent or expired. |
| Section 8(5) & Section 8(6) Reasonable Security & Breach Reporting |
Replicating massive datasets across multiple AI vendor servers exponentially multiplies data breach attack surface. | Zero data replication. Data never leaves custodian custody. Ephemeral enclaves eliminate persistent attack surfaces, protecting against ₹250 Cr penalties. |
| Section 9(1) & Section 9(2) Children's Data & Minor Tracking |
Unfiltered scraping indiscriminately vacuums up student and minor data, creating strict statutory violations for targeted tracking. | Automated age-flag metadata filtering halts ingestion of minor data unless verified parental consent (VPC) tokens are cryptographically linked. |
| Section 17(2)(b) Research & Statistical Exemptions |
Exemptions are forfeited if data is used to take specific decisions affecting individual Data Principals. | Blind enclaves enforce strict statistical aggregation, mathematically guaranteeing research data cannot be deanonymized to target individuals. |
6. What Indian CTOs, AI Founders, and CISOs Must Do Now
With the Handbook now released and pilot sandboxes expanding across banking, healthcare, and telecom, engineering leaders must prepare their production data pipelines:
⚡ Actionable Readiness Checklist
- Audit AI Training Ingestion Pipelines: Immediately audit what data internal LLMs, recommendation engines, and scoring algorithms are ingesting. Ensure no raw customer PII is flowing into un-sandboxed model checkpoints.
- Implement Upstream Consent Gating: You cannot participate in the DEPA AI ecosystem without clean, verifiable, statutory consent artifacts. Deploy an affirmative Consent Management Platform capable of issuing cryptographic notice hashes.
- Evaluate Confidential Computing Instances: Explore hardware-enclave instances (such as AWS Nitro Enclaves, Azure Confidential VMs, or GCP Confidential Compute) within Indian cloud regions (Mumbai/Hyderabad/Delhi).
- Establish Clean Room Governance: Replace informal data-sharing NDAs with machine-executable data collaboration contracts specifying bounded training purposes, duration, and differential privacy thresholds.