Data Empowerment and Protection Architecture (DEPA)

The Data Empowerment and Protection Architecture, or DEPA, is India's framework for letting people and institutions share data safely, with control. Its basic idea is simple: data about you should work for you. You should be able to send your data from one institution to another (say, from your bank to a lender) only when you agree, only for a stated purpose and only for a limited time.

DEPA is often called the "consent layer" of India Stack, the set of digital public building blocks that also includes Aadhaar and UPI.

Why does it exist?

Indian institutions hold huge amounts of data about people: bank statements, tax returns, health records, school marks. But this data was locked in separate "silos". A small shopkeeper with years of regular GST payments might still be refused a loan because the bank could not easily and safely see that record. People often shared data by handing over paper copies or passwords, which is unsafe.

DEPA was designed to solve both problems at once: empower people to use their own data, and protect them from misuse.

Where did it come from?

• 2016: The Reserve Bank of India (RBI) issued its Master Direction on Non-Banking Financial Company: Account Aggregators. This created a new kind of licensed body to move financial data with consent.
• August 2020: NITI Aayog released a draft discussion paper on DEPA, prepared with the volunteer tech group iSPIRT, and invited public comments until 1 October 2020. It described DEPA as a techno-legal framework built around consent managers.
• September 2021: The Account Aggregator network went live commercially, the first full use of DEPA in finance.
• 2023: The Digital Personal Data Protection (DPDP) Act, 2023 gave legal recognition to Consent Managers registered with the Data Protection Board.
• 2023 onwards: iSPIRT developed DEPA for Training, extending the idea from sharing one person's data to training AI on large datasets. It ran as a pilot.
• October 2026: MeitY released the DEPA for AI Training handbook, the government's first step to take this approach nationwide.

How does classic DEPA work, step by step?

Take a person who wants a loan using their bank data.

1. The lender (the data user) asks for the person's bank statement through a consent manager.
2. The consent manager shows the person a clear request: what data, for what purpose, for how long.
3. The person approves on their phone. This is recorded as a digital consent artefact, a machine-readable record of the permission.
4. The bank (the data provider) sends the data, encrypted, to the lender.
5. The consent manager is data-blind: it passes the data along but cannot read or store it.
6. The person can see the log of all consents and withdraw consent later.

Think of the consent manager as a sealed courier service. It carries your locked parcel from one place to another, only with your signed permission slip, and it has no key to open the parcel.

The key parts of the system

• Data Principal: the person the data is about.
• Data provider: the institution holding the data (in finance, called a Financial Information Provider, such as a bank).
• Data user: the institution that wants the data (in finance, a Financial Information User, such as a lender).
• Consent manager: the go-between that records and carries out consent (in finance, the Account Aggregator, licensed by the RBI).
• Open standards: common technical rules, so any provider can talk to any user through any consent manager.

Why is AI training different?

Classic DEPA works one person at a time. Training an AI model needs data on lakhs or crores of people at once, for example lakhs of X-rays to teach a model to spot TB. Asking each person for consent is very hard, and many old records cannot be traced back to their owners. So DEPA for AI Training moves from "permission from each person" to "protection by design":

• De-identification: names and identity numbers are removed or replaced with coded keys held by the original institution (this is called pseudonymisation).
• Secure data environments: the model is trained inside a locked computing space, sometimes described as a "sealed room". The developer gets the trained model but never sees the raw data. This uses confidential computing, where data stays encrypted and protected even while being processed.
• Differential privacy: carefully measured random "noise" is added, so that the model's results do not change noticeably whether or not any one person's record is included. This makes it very hard to work backwards from the model to a person.
• Data Collabs: intermediaries that pool data from many providers for one sector, such as health or credit.
• Certification and oversight: an authority checks that a trained model is "fit for use" and can suspend misuse, with a multi-stakeholder body (data providers, developers, experts, civil society) to guide the system.

Why is removing names not enough?

Data can often be re-identified by combining it with other data. In a well-known 2008 study, researchers re-identified users in a Netflix dataset where names had been replaced with numbers, by matching it with public movie ratings on another website. This is why DEPA for AI Training adds secure environments and differential privacy on top of removing names.

How does it connect with the law?

• Right to privacy: In Justice K.S. Puttaswamy v. Union of India (2017), a nine-judge bench held that privacy is a fundamental right under Article 21. Any limit on it must pass a test of legality (a law must exist), legitimate aim and proportionality (no more intrusion than needed).
• DPDP Act, 2023: personal data can usually be processed only with consent or for certain "legitimate uses". Section 17(2)(b) exempts processing for research, archiving or statistical purposes if the data is not used to take a decision about a specific person and follows prescribed standards. Under the DPDP Rules, 2025, these provisions apply from May 2027.
• Children's data: the DPDP Act needs verifiable parental consent to process a child's data and bars tracking and behavioural monitoring of children, with some exemptions under the Rules.

India's position and Indian examples

• Account Aggregator network in finance: the most mature DEPA system; Sahamati is its RBI-recognised self-regulatory organisation.
• Health: the Ayushman Bharat Digital Mission uses consent-based sharing of health records.
• AI data: the IndiaAI Mission's datasets platform, AIKosh, hosts datasets for Indian AI developers.
• India presents this model of digital public infrastructure abroad as an alternative to data controlled only by big private platforms.

Commonly confused concepts

• DEPA vs DPDP Act: DEPA is a framework and technical design for safe data sharing. The DPDP Act is a law that sets rights, duties and penalties. DEPA systems must follow the DPDP Act.
• DEPA vs Account Aggregator: The Account Aggregator is one use of DEPA, in finance, regulated by the RBI. DEPA is the wider idea that can apply to health, telecom, education and AI.
• Consent manager vs data fiduciary: A data fiduciary decides why and how personal data is processed (like a bank or hospital). A consent manager only helps the person give, manage and withdraw consent.
• Anonymisation vs pseudonymisation: Anonymised data cannot be linked back to a person at all. Pseudonymised data has names replaced by codes, but someone holding the key can still re-link it.
• Training vs inference: Training builds a model from large, combined data. Inference uses the finished model on one person's data to make a decision about them.

Issues, criticism and the way forward

• Moving away from individual consent: Critics say that dropping individual consent for training weakens people's control over their data, which is the very idea DEPA began with. Supporters respond that consent at this scale is not workable and that strong technical safeguards protect people better than a tick-box.
• Re-identification risk: No de-identification method is perfect. The strength of safeguards like differential privacy depends on settings that the public cannot easily check.
• Unclear oversight: The handbook does not name the "competent authority" that certifies models, and it mixes self-regulation with government oversight. Clear accountability is still needed.
• Fairness and benefit-sharing: Public hospitals and agencies hold data collected from citizens. Who earns from royalty or access-fee models, and whether patients benefit, is a live debate.
• Way forward suggested by experts: clear legal backing, independent audits of secure environments, public registers of datasets and models, strong penalties for re-identification, and special care for health and children's data.

Concepts to Know

• India Stack: A set of open digital systems built for India: identity (Aadhaar), payments (UPI), documents (DigiLocker) and data sharing with consent (DEPA).
• Encryption: Turning data into a secret code that only someone with the right key can read.
• AI model training: Showing a computer program a very large number of examples so that it learns patterns, for example many scans marked "TB" and "not TB".
• Re-identification: Working out who a person is from data that was supposed to be anonymous, usually by matching it with another dataset.
• Regulatory sandbox: A controlled space where new products are tested with real users under relaxed rules and close watch by a regulator.
• Digital public infrastructure (DPI): Shared digital systems built for public use, on which both government and private services can run.