Readiness assessment
The Act
The DPDP Act, explainedThe DPDP Rules 2025

Ch IPreliminary

S.1 Short title and commencementS.2 DefinitionsS.3 Application and scope

Ch IIObligations of Data Fiduciary

S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data Fiduciary

Ch IIIRights and duties of Data Principal

S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data Principal

Ch IVSpecial provisions

S.16 Transfer outside IndiaS.17 Exemptions

Ch VData Protection Board of India

S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the Chairperson

Ch VIBoard powers and procedure

S.27 Powers and functions of the BoardS.28 Procedure followed by the Board

Ch VIIAppeal and dispute resolution

S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertaking

Ch VIIIPenalties

S.33 Penalties and the ScheduleS.34 Penalties to Consolidated Fund

Ch IXMiscellaneous

S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other Acts
Industries
Fintech & BFSIPayments & UPIUPIWalletsLendingBNPLLSPsKYCVideo-KYCAadhaar eKYCWealthtechInsurTechHealth insuranceDebt collectionsBanksNBFCsNGOsHealthcare & PharmaHospitalsDiagnostic labsGenetic testingPharmaClinical trialsTelemedicineE-commerce & RetailD2CMarketplacesLogisticsLoyalty & CRMGCCsSaaS & TechnologyAI & MLFoundation modelsB2B SaaSCloudDeveloper toolsEdTech & EducationSchoolsCoachingLMSProctoringChildren-directed appsGovernment & PSUe-GovernancePublic servicesUtilitiesManufacturingAutomotiveDealersIndustrialIoTMedia & EntertainmentAdTechGamingOTTPublishingSocial mediaBrowse all sectors
Implementation
All 17 DPDP servicesFintech & digital lendingGCC & global centresDPDP Compliance AssessmentFind where you stand and your gapsDPDP Gap AssessmentGaps mapped to sections and rulesDPDP ImplementationTurn the rules into daily practiceData MappingKnow what data you hold, and whereRoPAYour record of processing activitiesPrivacy AuditIndependent check of your controlsDPO ServicesOutsourced or part-time DPOSDF ReadinessCheck for extra SDF dutiesConsent ManagementCapture, track and withdraw consentNotice & Consent RemediationFix notices and consent flowsData Principal RightsHandle access, correction, erasureRetention & DeletionWhat to keep, how long, how to deleteVendor & Processor ManagementControl third parties handling dataChildren's DataRules for handling minors' dataSecurity SafeguardsTechnical and organisational controlsBreach ResponseWhat to do when a breach happensPrivacy Operations SupportKeep the programme runningDPDP TrainingTrain staff, legal and leaders
Training
All DPDP Act trainingEmployee awarenessCorporate trainingLeadership briefingDPO and certification
Resources
Readiness assessmentGuidesBy roleGlossaryCompareNews
About
AboutEditorial policyContactFAQ
Readiness assessment
Share this article

News

DEPA for AI Training Handbook: what MeitY launched on 31 October 2026

On 31 October 2026 MeitY launched a handbook on DEPA for AI Training, with support from the iSPIRT Foundation. It describes a framework for sharing data for AI training under agreed permissions. The PIB release does not mention the DPDP Act.

Team DPDP Act India

Based on the PIB release of 31 October 2026. We have not reviewed the handbook text. Last checked: 1 November 2026.

In brief: On 31 October 2026 the Ministry of Electronics and Information Technology (MeitY) launched the Handbook on Data Empowerment and Protection Architecture (DEPA) for AI Training at a roundtable in Bengaluru, with support from the iSPIRT Foundation. The PIB release describes a framework that lets institutions share data for AI training while keeping control of it. The release does not mention the DPDP Act, so how the two fit together is still open. The DPDP dates are unchanged: Consent Manager registration opens on 13 November 2026 and the main duties start on 13 May 2027.

What did MeitY launch on 31 October 2026?

MeitY launched the Handbook on Data Empowerment and Protection Architecture (DEPA) for AI Training at a high-level roundtable in Bengaluru. Shri S. Krishnan, Secretary, MeitY, unveiled it, with support from the iSPIRT Foundation. PIB Bengaluru published the release at 11:44 AM on 31 October 2026.

The launch at a glanceWhat the PIB release says
Launched byMinistry of Electronics and Information Technology (MeitY), Government of India
Unveiled byShri S. Krishnan, Secretary, MeitY
WhereHigh-level roundtable, Bengaluru
Supported byiSPIRT Foundation
TitleHandbook on Data Empowerment and Protection Architecture (DEPA) for AI Training
Described asA techno-legal framework for purpose-bound data collaboration

What is the DEPA for AI Training framework?

According to the PIB release, the DEPA Training framework lets institutions make data available for AI training and still keep control over it. DEPA stands for Data Empowerment and Protection Architecture. The release names four building blocks:

  • Contractual permissions. Agreed terms that set out what the data may be used for.
  • Controlled computing environments. The release quotes Prof. Ajay Kumar Sood, Principal Scientific Adviser, as saying that under DEPA the model goes to the data, instead of the data going to the model.
  • Privacy-enhancing safeguards. Technical protections for privacy, commercial confidentiality and institutional control.
  • Data provenance. The origin, permissions and use of data can be traced throughout the training process.

The stated aim is to open up access to large datasets for AI training while safeguarding privacy, commercial confidentiality and institutional control.

What does the PIB release not say?

The release does not mention any of the following:

  • The DPDP Act, 2023 or the DPDP Rules, 2025
  • Consent or Consent Managers
  • The Data Protection Board

It also does not describe the handbook as a draft, although some news outlets do. We have not seen the handbook itself, so check its cover page for its status.

How does this relate to the DPDP Act?

The release does not say. The handbook may address it, and we will update this page once we have read it. Until then, these points are already fixed in the Act and the Rules:

  • The dates stand. Under G.S.R. 843(E), Consent Manager registration (Rule 4) opens on 13 November 2026. The main duties, including notice and consent, begin on 13 May 2027.
  • Consent has a standard. Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data the purpose needs. If consent is the basis for processing and it is disputed, section 6(10) obliges the Data Fiduciary to prove that notice was given and consent was obtained.
  • Roles matter. Organisations that share data usually need to work out who is the Data Fiduciary and who is a Data Processor in the arrangement.

Whether and how these duties apply to a DEPA-style arrangement is a question for the handbook text and for legal advice. We do not predict how regulators will treat it.

What should organisations do now?

  • Keep to your DPDP timeline. Nothing in the release changes the dates. See our compliance timeline.
  • Know what is in your datasets. If others may want your data for AI training, list the personal data in each dataset and the purposes you told people about. Our data mapping guide shows how.
  • AI and ML teams: read the handbook and check how its permissions line up with your obligations as an AI or ML business.

What happens next?

We will read the handbook and update this page, including its status and any link to the DPDP Act. Details may change as MeitY and iSPIRT publish more.

Frequently asked questions

What is the DEPA for AI Training Handbook?

It is a handbook launched by MeitY on 31 October 2026, with support from the iSPIRT Foundation. According to the PIB release, it sets out a techno-legal framework for purpose-bound data collaboration, so that institutions can share data for AI training while keeping control of it.

Who launched it and when?

MeitY launched it at a high-level roundtable in Bengaluru on 31 October 2026. S. Krishnan, Secretary, MeitY, unveiled it.

What does DEPA stand for?

Data Empowerment and Protection Architecture.

Does the handbook mention the DPDP Act?

The PIB release does not mention the DPDP Act, consent, Consent Managers or the Data Protection Board. We have not read the handbook text.

Is the handbook final or a draft?

The PIB release does not describe it as a draft, though some news outlets do. We have not seen the handbook text, so check its cover page for its status.

Does this change the DPDP compliance dates?

No. Consent Manager registration opens on 13 November 2026 and the main duties begin on 13 May 2027 under G.S.R. 843(E).

Sources

This is general information, not legal advice. It is based on a PIB press release, not on the handbook text. Speak to your counsel before acting on it.

Related sections

Keep reading

Consent Manager guideSection 6: consentDPDP compliance timelineDPDP Act for AI and MLNews: Supreme Court notice on the news publishers’ challengeAll DPDP Act news