India’s AI-training handbook keeps data in place—but it is guidance, not a guarantee
India's IT ministry says DEPA Training will combine contracts, controlled computing, privacy safeguards and provenance so models can work with institutional data without moving raw records. The launch release provides no adoption figures, timetable or evaluated outcome.
The short version
- What happened
- India's Ministry of Electronics and Information Technology launched a handbook for purpose-bound AI-training collaboration on 31 October, developed with support from iSPIRT Foundation.
- Who it affects
- Patients, customers, students and public-service users could benefit if institutions train useful models without handing over raw records. They also need enforceable consent, audit and remedy mechanisms because keeping data in one place does not prevent every privacy or discrimination risk.
- What remains unproven
- This is an official launch announcement about a handbook, not a law, audited standard or peer-reviewed evaluation.
Keep in mind
This is an official launch announcement about a handbook, not a law, audited standard or peer-reviewed evaluation.
The release gives no number of participating institutions, datasets, training runs, users or evaluated pilots and no implementation timetable.
The accessible primary page did not provide enough handbook text to verify detailed consent, withdrawal, enforcement, cross-border and model-extraction controls.
Source analysis · 1 linked source. Primary analysed source date: 31 October 2026.
Read the full report · 4 min The evidence, methods, implications and limitations
The proposal moves computation instead of copying raw data
India's Ministry of Electronics and Information Technology has launched a handbook intended to let institutions collaborate on AI training while keeping control of their datasets. The Data Empowerment and Protection Architecture for AI Training, developed with support from iSPIRT Foundation, combines purpose-specific contracts, controlled computing environments, privacy safeguards and records of where data came from, what permissions apply and how it was used.
The practical idea is that an approved model or training process enters a governed environment rather than a hospital, bank, university or public agency exporting raw records to a developer. That could make collaboration possible where privacy, commercial confidentiality, intellectual property or institutional duties currently block ordinary data transfers. For people represented in those datasets, the important questions are whether consent and purpose limits survive model training, who can inspect the audit trail and what happens when trained parameters leave the secure environment.[1]
A handbook cannot establish trust on its own
The launch release describes architecture and ambition, not a binding rule or evaluated deployment. It does not identify a participant denominator, datasets opened under the framework, a start date, an enforcement authority or results from privacy, security, bias or model-quality tests. The accessible government page also does not expose enough handbook detail to assess contract language, withdrawal rights, cross-border controls or whether a data holder can verify what a trained model retained.
That distinction matters for hospitals and banks asked to join a future collaboration. Keeping records in place can reduce some transfer risks, but a model can still memorise sensitive information, reproduce bias or create outputs that reveal patterns about small groups. Confidence should rise only when pilots publish their governance documents, threat models, privacy tests, audit access, complaints route and measurable outcomes. Until then, DEPA Training is a policy design for controlled access—not proof that valuable data can be shared safely at scale.[1]
The distinction that matters
What the government says DEPA Training combines
Three layers are intended to keep collaboration purpose-bound while data remains under institutional control.
Permission
Contractual terms define the purpose and permitted use
Data holders retain a formal basis for control
Compute
The training process runs in a controlled environment
Raw institutional data need not be copied to the model builder
Accountability
Provenance tracks origin, permissions and use
Auditors can ask what data contributed and under which authority