Technology
India Launches ‘Sealed Room’ Framework to Train AI on Sensitive Data In‑Place
India unveiled a new system on Friday that lets companies and researchers train artificial intelligence models on data held by hospitals, banks and government agencies without the data leaving those institutions. The Data Empowerment and Protection Architecture (DEPA) for AI Training framework was introduced by the Ministry of Electronics and Information Technology (MeitY) and was developed mainly by iSPIRT, a volunteer‑led technology think‑tank that has worked on India’s Unified Payments Interface (UPI) and India Stack, which supports services such as Aadhaar, payments and secure data sharing.
DEPA’s core idea, explained by a senior government official at the Bengaluru launch, is to bring AI models to the data rather than moving the data to researchers. The framework builds on a 2020 NITI Aayog concept that allowed citizens to share their data with consent. iSPIRT’s version extends this to training AI on sensitive data belonging to millions of people while keeping the data within the owning institutions.
Consultations on DEPA for AI will begin in the coming weeks, before it is formalised under a legal framework—a process that could take years, the stakeholders said. The launch comes as India prepares to implement its first data privacy law, the Digital Personal Data Protection (DPDP) Act, 2023, in the coming months.
Under DEPA, data remains with its owner while a “sealed room” – a secure computing environment – runs only what an authorised digital contract permits. No one, not even the company operating the system, can access the data inside. A developer sends in an AI model and receives only the trained model or, in some cases, the decision output.
Early pilots were demonstrated on Friday. In one trial, a bank that has been testing the approach since March 2026 identified which fintech customers qualified for its credit cards before seeking consent, and then requested permission only from those who had a real offer. The pilot handled more than 2 million requests in two weeks. In another pilot, hospitals and a health‑tech startup trained a tumour‑detection model on MRI scans that the startup never saw.
Attendees at the event included Ajay K Sood, principal scientific adviser to the government; MeitY secretary S. Krishnan; iSPIRT co‑founder Sharad Sharma; and representatives from HDFC Bank, Sarvam and Emergent AI.
The framework could be key for hospitals and banks that rarely share data, earn little from it and risk fines of up to ₹250 crore under India’s data protection law if it leaks. A banking executive noted that India’s consent‑based data‑sharing framework solves the individual consent problem but not the collective problem, citing fraud that spans multiple banks.
For now, DEPA’s day‑to‑day management is expected to be handled by Samyog, a new industry group “powered by iSPIRT.” Its website says it will register participants, provide standard contracts and resolve disputes. The board includes Sharma and other leaders who helped write the handbook. The site does not say Samyog is government‑appointed.
iSPIRT executives said data owners, such as hospitals and banks, would be paid each time their data is used, but the handbook only says that payment methods “will be explored.” It also does not specify who would be liable if data were to leak from a sealed room.
The framework is not legally binding, and officials did not say if or when it might become so. The path forward includes pilots in finance and healthcare and regulatory sandboxes where companies test models under supervision. Binding rules are more likely to come from sectoral regulators than through a new law, as was the case with India’s account aggregator system, which took five years to move from RBI rule‑making to launch.
Much also depends on the Digital Personal Data Protection Act, 2023, whose main rules take effect in May 2027. India continues to explore dedicated AI legislation and is debating whether AI platforms need a new legal definition of protection, according to Mint reports.