MeitY proposes consent-based way to share data for AI training
MeitY has floated a draft DEPA framework to let India's startups train AI on sensitive data without seeing the raw records. Here is how it would work.
India's IT ministry (MeitY) has proposed a consent-based framework that would let startups, businesses and universities train AI models on large Indian datasets without ever holding the raw data, Inc42 reported on 31 October 2026. The plan, built with the think tank iSPIRT, extends the Data Empowerment and Protection Architecture (DEPA), the system behind Account Aggregator. It is a proposal, not a rule, and the details below rest mainly on that one report.
What was proposed
Inc42 describes a "consent-based framework to facilitate data sharing for training AI models in India". The stated goals are to give Indian developers access to India-specific datasets and to stay within the Digital Personal Data Protection (DPDP) Act. The report names three kinds of participants:
- Training Data Providers, such as banks, hospitals and government agencies, which hold the data.
- Training Data Consumers, meaning startups, enterprises, researchers and individuals who want to train models.
- Data Collectives, intermediaries that standardise datasets and set the sharing rules.
The report gives no budget, no dataset counts and no deadline for comments. It also does not explain how an individual would give or withdraw consent, which is the most important open question.
How the process would work
Think of a sealed laboratory. The data owner puts its records in, the developer sends in a model to learn from them, and only the trained model comes out. Nobody outside sees the records. According to Inc42, the steps are:
1. Providers anonymise and encrypt their datasets and list them on a data exchange platform.
2. Each dataset is tagged with metadata and cryptographic identifiers so it can be traced.
3. Consumers ask for datasets for a stated use.
4. An electronic contract system checks the request against the sharing policy before access is granted.
5. Training happens in a secure environment using differential privacy, a mathematical method that limits how much any one person's record can influence the finished model.
The safeguards named include confidential clean rooms (hardware-protected environments), zero-trust security where every access request is authenticated, and independent checks of trained models for bias, fairness, security, safety and explainability. Only models that pass would move to pilots and wider use, with monitoring and traceability back to the data and contracts used.
The chart counts the parts and the open points.
Where the idea comes from
DEPA is India's existing architecture for consent-driven data sharing. A 2023 iSPIRT post by volunteer Kapil Vaswani introduced "DEPA for Training" as an extension of it, using digital contracts, clean rooms and differential privacy. That post gave examples such as detecting fraud using datasets held by several banks, and tracking disease. So the idea is not new, but the Inc42 report indicates the ministry is now putting its name to it.
Inc42 also notes that it follows TRAI's draft guidelines on AI in telecom (comments due 27 November) and comes weeks after IT minister Ashwini Vaishnaw said a consultation paper on AI safety and security regulation would arrive within a month. The article carries no criticism or expert reaction, so readers should treat the proposal as untested.
What it could mean for startups and lenders
For AI startups, the main promise is access. Training data in India is scarce in areas such as health and finance because the records sit with a few regulated holders who cannot simply hand them over. A clean-room route could let a small team train a credit-scoring or fraud model without signing a data-transfer deal that exposes customer records.
For banks and NBFCs, it could be a way to monetise or collaborate on data without breaching privacy law, but only if the contracts, liability and consent rules are clear. Those are exactly the details not yet reported.
Try pooling, using the multi-bank fraud example.
What to watch next
Look for the published draft text, the consultation window, the rules on consent and withdrawal, and the promised AI safety and security consultation paper.
## Key takeaways
- MeitY has proposed a draft, consent-based DEPA framework for sharing data to train AI, built with iSPIRT.
- Models would be trained inside secure environments so developers never see raw data.
- Differential privacy, electronic contracts and independent model checks are the main safeguards named.
- The consent mechanics, the liability rules and the comment deadline have not been reported.
- Only one outlet's account was available to us, so details may change once the draft is read in full.
Sources
- [Inc42: MeitY floats framework to unlock data for training AI models](https://inc42.com/buzz/meity-floats-new-privacy-led-framework-to-unlock-data-for-training-ai-models/)
- [iSPIRT (ProductNation): Introducing DEPA for Training, DPI for Responsible AI](https://pn.ispirt.in/introducing-depa-for-training-dpi-for-responsible-ai/)
Tags: AI governance MeitY DPDP Act Data privacy Account Aggregator