A Reversed Framework: The Model Goes to the Data, Not the Other Way Around

The Indian Ministry of Electronics and Information Technology (MeitY) has formalized the Data Empowerment and Protection Architecture (DEPA), a system designed to train AI models directly on local data without transferring it to foreign servers. According to the Register, this approach relies on a simple principle: « the model travels to the data, rather than the data to the model », as summarized by India’s chief scientific advisor, Professor Ajay Kumar Sood.

In practice, Training Data Providers (TDPs), including hospitals, banks, government agencies, or businesses, will send anonymized and encrypted data to a Data Exchange Platform (DEP). The Training Data Consumers (TDCs), whether startups or large corporations, will access this data to train their models in secure and isolated environments, known as Secure Data Environments. These environments ensure that data remains encrypted and contained throughout the entire process, as outlined in the framework published by MeitY.

DEPA is a revolution in data governance: the AI model moves toward the data, not the other way around, thus preserving the sovereignty of the institutions that hold it.

Technical and Legal Safeguards to Prevent Data Leaks

DEPA does more than just secure data: it enforces strict rules on its usage. TDPs will be able to define, through contracts and contractual permissions, how their data can be used by TDCs. For example, a hospital may prohibit the use of its medical data for models unrelated to healthcare, according to details provided by The Economic Times.

To enhance transparency, the framework integrates differential privacy techniques to prevent models from extracting individual information, even indirectly. All activities within secure environments will be immutably recorded for audits, as indicated by MeitY. This traceability, known as data provenance, allows tracking the origin of the data, its permissions, and its usage throughout the entire model training cycle.

Finally, DEPA combines cryptographic guarantees and controlled computing environments to isolate sensitive data. Tests conducted by HDFC Bank, one of the first institutions to adopt DEPA, have confirmed the viability of this system in sectors subject to strict regulations, as reported by The Times of India.

A lever for key sectors: health, finance, and education

DEPA aims to unlock fragmented data in sectors where sharing is currently limited by confidentiality constraints. In healthcare, for example, the framework could enable the aggregation of medical data scattered between public hospitals and private clinics to train AI models dedicated to diagnostics, drug discovery, or epidemic management, as highlighted by The Register. In finance, secure access to banking data could help extend credit to populations currently excluded, such as the 400 million unbanked individuals or SMEs in India.

In education, DEPA could facilitate data interoperability between institutions to develop personalized learning tools or transferable skills certification systems, a major challenge in fragmented education systems. MeitY presents this framework as a response to interoperability challenges that hinder innovation in these sectors.

What this changes here: a path for Africa in the face of data leakage risks

For businesses and administrations in West Africa, where data sovereignty and trust in local digital infrastructures remain major issues, DEPA offers a model to study. Countries in the region, facing increased risks of leaks of sensitive data to foreign actors or power imbalances in technological partnerships, could draw inspiration from this approach to:

• Avoid data exfiltration: as in Benin, where medical or financial data is often processed by international platforms, DEPA demonstrates that it is possible to train AI models without exporting raw data, thus reducing risks of privacy breaches or non-compliance with the African General Data Protection Regulation (African GDPR) in preparation.
• Strengthen sectoral collaboration: sectors like public health or financial services, where data is currently siloed between institutions, could benefit from a similar framework to aggregate datasets without compromising security. For example, a system inspired by DEPA would allow Beninese hospitals to share anonymized data to train telemedicine tools while retaining control over their use.
• Limit dependence on tech giants: by enabling models to train on-site, DEPA reduces the need to rely on foreign actors for data processing. For African administrations, this could mean fewer data transfers to servers located outside the continent, and thus fewer risks of censorship or interference in the analysis of local data.
• Create a trusted ecosystem: the traceability and audits integrated into DEPA could serve as a reference to establish local data governance standards. In Benin or Senegal, where initiatives like the National Agency for Personal Data Protection (ANPDP) are emerging, a technical framework like India’s could help harmonize practices between public and private sectors.

However, the adoption of such a system in West Africa would raise specific challenges: the maturity of digital infrastructures, the training of local stakeholders in these new technologies, and the coordination among states to avoid a fragmentation of rules. Pilot projects, such as those led by the African Development Bank (AfDB) on data sovereignty, could serve as a springboard to test regional adaptations of DEPA.

A diplomatic ambition: India proposes a global standard for AI

Beyond its local applications, DEPA is presented as a contribution from India to global scientific diplomacy, aligned with the efforts of the World Bank and the UN for a more inclusive AI ecosystem. The MeitY emphasizes that this framework continues the legacy of India’s Digital Public Infrastructures (DPI), such as the Unified Payments Interface (UPI) or Bharat Taxi, designed to reduce dependence on tech giants and give citizens control over their data.

For the Secretary of Information Technology, S Krishnan, « India’s ambitions in AI must be matched by responsible and secure data usage ». This statement reflects a growing concern in developing countries: how to leverage AI without replicating data-related power imbalances? DEPA could thus become a model for nations aiming to develop their own AI ecosystem, without compromising sovereignty or data security.