The Ministry of Electronics and Information Technology has unveiled a handbook on the Data Empowerment and Protection Architecture, or DEPA, in a move that could shape how Indian institutions share data for artificial intelligence development. The handbook lays out a techno-legal framework intended to make data exchange more structured, consent-based and auditable, while allowing organisations to retain control over their information assets.
The release comes at a time when India's AI ecosystem is expanding rapidly, but access to high-quality data remains one of its most persistent bottlenecks. Startups, research institutions and public agencies increasingly need large, diverse datasets to train models, improve accuracy and reduce bias. At the same time, concerns around privacy, data ownership and misuse have made many institutions cautious about opening their systems to external use. DEPA is positioned as a middle path: a framework that enables collaboration without forcing institutions to surrender control.
Trusted Data Rails
At its core, the handbook seeks to translate a policy concept into operational practice. DEPA is built around the idea that individuals and institutions should be able to authorise the use of their data in a secure, standardised manner, rather than through ad hoc bilateral arrangements. For AI training, that could mean enabling access to relevant datasets through governed interfaces, with permissions, traceability and purpose limitation built into the process.
This matters because AI systems are only as good as the data used to train them. In sectors such as finance, health, education and public services, data is often fragmented across silos and held by entities that are reluctant to share it due to compliance risk or competitive concerns. A handbook that clarifies the legal and technical architecture for data sharing may help reduce uncertainty and encourage more institutions to participate in data collaborations.
The framework also reflects a broader policy shift in India toward digital public infrastructure that is designed to be interoperable, scalable and privacy-aware. Rather than treating data as a static asset locked inside institutional boundaries, DEPA treats it as something that can be exchanged under defined rules. That approach could be particularly relevant for startups building AI products, which often struggle to secure lawful access to training data at the scale required for commercial deployment.
AI Access, Privacy Balance
The significance of the handbook extends beyond AI alone. It signals that the government is trying to build a governance layer for the next phase of India's digital economy, one in which data mobility and privacy protection are not seen as opposing goals. If implemented effectively, the framework could help institutions share data for innovation while maintaining accountability over who accesses it, for what purpose and under what conditions.
For startups and venture-backed companies, the implications are substantial. Access to trusted datasets can shorten product development cycles, improve model performance and lower the cost of compliance. It can also create opportunities for new intermediaries, including consent managers, data fiduciaries, infrastructure providers and compliance technology firms. In that sense, DEPA is not just a policy document; it may become part of the commercial plumbing of India's AI economy.
The challenge, however, will be execution. A techno-legal framework is only as effective as the institutions that adopt it and the standards that support it. Questions remain around interoperability, enforcement, liability and the practical burden on smaller organisations that may lack the technical capacity to implement such systems. The handbook will need to be matched by clear rules, usable tools and broad institutional buy-in if it is to move beyond policy intent.
Still, the release marks an important step in India's attempt to reconcile innovation with governance. As AI adoption accelerates, the ability to share data securely and lawfully will become a competitive advantage, not just a regulatory requirement. By formalising the principles of trusted data exchange, MeitY is signalling that the country wants to build AI on a foundation of controlled access rather than unrestricted extraction.
For the startup ecosystem, that could prove decisive. The next wave of AI companies will likely depend less on raw model ambition and more on access to reliable, permissioned data. DEPA's handbook suggests the government is aware of that reality and is trying to create the conditions for data-rich innovation without weakening the protections that make such innovation sustainable.