For the past four years, the global artificial intelligence pipeline has operated on a simple colonial extraction model: data travels to the model. Billions of pages of regional text, medical records, financial transactions, and educational interactions generated across the world are scraped or exported into massive, centralized data centers in the United States, Europe, or China, where frontier labs train proprietary weights and rent access back via paid APIs.
On Monday, November 2, 2026, India’s Ministry of Electronics and Information Technology (MeitY ) unveiled a national architectural blueprint designed to flip that paradigm on its head. Under the newly published Data Empowerment and Protection Architecture (DEPA) for AI Training , raw domestic datasets never leave local custody to be ingested by offshore Big Tech clusters. Instead, as Professor Ajay Kumar Sood, Principal Scientific Adviser to the Government of India, summarized the doctrine: “The model travels to the data, rather than the data travelling to the model.”
Built as the next layer of India’s pioneering Digital Public Infrastructure (DPI) stack—which previously produced the Unified Payments Interface (UPI) and zero-commission Bharat Taxi—the DEPA framework establishes a three-party confidential-computing marketplace connecting Training Data Providers (TDPs) , Data Exchange Platforms (DEPs) , and Training Data Consumers (TDCs) inside hardware-isolated Secure Data Environments (SDEs) .
For enterprise AI builders, cloud providers, and multinational SaaS companies operating in Healthcare, FinTech, and EdTech, India’s DEPA architecture is more than a regional policy paper: it is the first national technical standard requiring confidential computing, mandatory differential privacy, and immutable audit logs as a precondition for training AI on sovereign institutional data.
The Core Inversion (“Model Travels to the Data”): Formulated by MeitY and Principal Scientific Adviser Prof. Ajay Kumar Sood, AI developers must ship their un-trained or base model containers into local encrypted enclaves rather than exporting datasets to external clouds.Three-Role Marketplace Architecture: 1. Training Data Providers (TDPs): Hospitals, banks, universities, and government agencies that own valuable datasets and set explicit usage/monetization rules. 2. Data Exchange Platforms (DEPs): Regulated intermediaries that ingest anonymized, encrypted TDP datasets and operate the compute enclaves. 3. Training Data Consumers (TDCs): AI labs, startups, and enterprises that dispatch models into the DEP to train or fine-tune weights.Hardware-Based Secure Data Environments (SDEs): DEPs execute training inside hardware-isolated confidential computing enclaves where data remains encrypted and isolated even during active processing, backed by immutable audit logs and mandatory differential privacy so trained weights cannot memorize or leak individual records.Massive Sector Targets (Healthcare, FinTech, EdTech): MeitY targets DEPA to unlock fragmented clinical data for AI diagnostics, connect thousands of Indian banks to extend formal credit to 400 million underserved individuals and MSMEs , and build personalized AI learning and portable skill credentials for 250 million students across India’s $29 billion EdTech sector . Inside the DEPA Architecture: How Confidential Enclave Training Works
Why haven’t hospitals, regional banks, and state education boards shared their rich structured datasets with AI developers up to now? Because once a hospital exports a CSV or Parquet dump of 10 million patient scans to an external AI startup’s S3 bucket, the hospital loses all technical control over where that data is copied, whether a patient’s identity can be reconstructed from the model weights, and whether the startup resells the dataset.
MeitY’s DEPA for AI Training solves that trust impasse by combining contractual policy enforcement with hardware-level confidential computing :
Architectural Layer
Traditional Centralized AI Training
India’s DEPA “Model Travels to Data” Architecture
Data Movement Raw/scraped data exported to AI vendor’s cloud VPC
Data stays inside regulated Data Exchange Platform (DEP)
Execution Boundary Standard multi-tenant or vendor-owned GPU cluster
Hardware-based Secure Data Environment (SDE) (encrypted in use)
Privacy Protection Best-effort PII scrubbing; high memorization risk
Systematic Differential Privacy preventing individual record leakage
Governance & Audit Opaque internal training runs; legal lawsuits over scraping
Immutable audit logs enforcing TDP-defined usage rules
Look at how a practical fine-tuning run executes under the DEPA workflow:
Encrypted Ingestion (TDP $\rightarrow$ DEP): A consortium of Indian hospitals or regional banks (Training Data Providers ) anonymizes and encrypts structured clinical or credit records and deposits them with a certified Data Exchange Platform , attaching machine-readable policy rules specifying who may train on the data and for what purpose.Model Dispatch (TDC $\rightarrow$ SDE): An AI healthcare startup or financial model builder (Training Data Consumer ) packages its base model architecture and training script and submits it to the DEP’s hardware-based Secure Data Environment (leveraging confidential-compute technologies such as Intel TDX, AMD SEV-SNP, and Nvidia H100/Blackwell Confidential Computing).Differential Privacy & Immutable Auditing: Inside the SDE, the training loop runs over the decrypted data strictly within hardware-protected memory that even the cloud host cannot inspect. At the same time, the SDE systematically injects differential privacy noise into the gradients so the resulting model weights mathematically cannot memorize or regurgitate any individual citizen’s medical chart or bank balance. Every epoch and parameter access is written to an immutable audit log, and only the verified, privacy-certified model weights are exported back to the developer.
Why DEPA Matters for Global AI Builders Beyond India
While MeitY’s immediate goal is domestic—unlocking formal credit for 400 million underserved citizens and MSMEs and powering tools for 250 million students without handing a monopoly to US or Chinese hyperscalers—the framework explicitly positions DEPA as “India’s contribution to global science diplomacy, advancing the efforts of institutions such as the World Bank and the United Nations.”
Just as India’s UPI real-time payments architecture was subsequently studied and replicated across dozens of emerging economies in Southeast Asia, Africa, and Latin America, DEPA for AI Training provides a ready-made blueprint for every sovereign nation and regulated enterprise that wants custom domain AI models without surrendering raw data to offshore cloud giants.
The 4-Step Enterprise Implementation Playbook
Containerize Your Training and Fine-Tuning Pipelines for Air-Gapped Enclaves: If your AI product targets healthcare, banking, public-sector, or education customers in India or other data-sovereign markets, stop assuming you can pipe customer logs back to your central US/EU AWS region. Package your LoRA/fine-tuning harnesses as self-contained, zero-egress containers that can be dispatched into a customer’s or DEP’s Secure Data Environment (SDE) .Build Differential Privacy (DP-SGD) Into Your Default Training Loop: Because DEPA mandates systematic differential privacy to prevent models from memorizing individual records, integrate libraries like Opacus (for PyTorch) or JAX Privacy into your fine-tuning stack today and benchmark how epsilon ($\varepsilon$) privacy budgets impact your model’s downstream accuracy.Target the 400M FinTech and 250M EdTech Opportunity With Small Open-Weight Models: Sending a 2-trillion-parameter frontier model into a third-party confidential enclave is slow and expensive. Compact, high-efficiency open-weight models (8B to 30B parameters, such as Gemma 4, Llama, or Qwen) are ideal for traveling into DEPA enclaves to train specialized credit-underwriting, agricultural, and vernacular education models.Adopt Hardware Confidential Computing on Your Current Cloud GPUs: Even outside India, enterprise healthcare and financial CISOs are demanding the exact guarantees described in DEPA. Enable Nvidia Confidential Computing on your H100/Blackwell instances and generate cryptographic remote-attestation receipts proving to enterprise clients that their training data remained encrypted in memory and was deleted immediately after the run.
Next Steps
