India's Ministry of Electronics and Information Technology has proposed a framework under which AI models train where regulated data is stored, instead of data owners sending information to developers. The scheme is called Data Empowerment and Protection Architecture for AI Training, or DEPA. Principal Scientific Adviser Ajay Kumar Sood described the principle as "the model travels to the data, rather than the data travelling to the model." The proposal matters because it offers a state-managed alternative to open collection of data for large language models.
How DEPA organizes access to training data
Under the proposal, organizations holding sensitive information become Training Data Providers, with hospitals, banks and government agencies named as examples. They would supply anonymized and encrypted data to a Data Exchange Platform. Developers seeking data for training, called Training Data Consumers, would gain access through those platforms rather than receiving raw datasets directly. India already operates several data exchanges, although the source notes it is unclear how much work remains to turn DEPA into a working system.
The platforms would run hardware-based Secure Data Environments in which data stays encrypted and isolated even during processing. Rules defined by data providers would control how consumers are allowed to use the information inside those environments. Differential privacy techniques would be applied systematically so models do not learn or reveal information about specific individuals. All activity inside the environments would be immutably logged for audit, a combination presented as making the process secure and transparent.
The initiative reflects India's argument that offshore model developers have limited incentive to address national problems or preserve control for data owners. It arrives while courts and policymakers debate whether developers of large language models may use publicly available data without payment. New Delhi has previously promoted digital public infrastructure such as the Unified Payments Interface and the Bharat Taxi zero-commission ride-sharing platform to limit dominance by large technology firms. The same infrastructure is also used diplomatically through transfers to friendly nations.
What DEPA changes for companies using AI
For businesses, the framework points to future access to fragmented local datasets that are currently difficult to combine for AI projects. MeitY expects health data to support diagnostics, drug discovery and public health management once sharing becomes possible under controlled conditions. Financial organizations could work with more diverse data without taking custody of raw customer records. Small firms would gain a regulated path to data they could not negotiate bilaterally, while large organizations would face standardized provider rules instead of separate agreements.
The financial inclusion case is quantified: India has thousands of banks, and the framework links secure sharing of financial data to potential formal credit for 400 million underserved individuals and small businesses. In education, DEPA is presented as a way to overcome interoperability problems for personalized learning and portable skill credentials, relevant to 250 million students and a $29 billion EdTech sector. These figures do not guarantee outcomes, so buyers should check data quality, coverage, consent terms and whether providers actually join the exchanges. The proposal alone does not resolve anonymization standards or commercial terms.
A marker to watch is whether MeitY moves from framework to operating exchanges with named providers, published access rules and audited training runs. Participation by hospitals, banks or agencies, plus use by outside developers, would show demand beyond policy documents. References to the World Bank and United Nations suggest India also seeks international support for the model. If other countries adopt compatible rules, cross-border compliant training could become a separate procurement criterion.
