Can cleanrooms solve India’s AI model training and data privacy conundrum?

Document Details
AUTHOR Anwesha Sen
DATENovember 2, 2026
CATEGORIES Privacy AI Regulation High Tech Geopolitics India

With only six months remaining until India’s DPDPA compliance deadline, questions around data protection in the AI age have become more pronounced. Last week, MeitY published the Data Empowerment and Protection Architecture (DEPA) for AI Training framework. While DEPA was originally a consent-driven framework designed for India’s DPI stack, the new framework attempts to address a question central to the role of data in India’s AI development story: how do we enable the use of massive, high-quality datasets for training foundational models without compromising individual privacy?

The initial physical manifestation of DEPA was Account Aggregators, introduced by RBI to manage financial data. Essentially, these are intermediaries who streamline the process of providing and revoking consent for data-sharing between an individual and a bank using the Account Aggregator framework. This framework makes sense for simple, one-time data-sharing tasks, such as sharing a bank statement to get a loan.

But training an AI model requires exponentially more data and is not comparable to such use cases. To fix this, the new DEPA framework brings in Secure Data Environments (SDEs), also known as “cleanrooms.” These are locked digital rooms where AI startups and researchers can upload their training code, and a Data Exchange Platform (DXP) provides the data. The institution (hospital, bank, and other fiduciaries) that provides the data to the DXP either anonymises it at source or anonymisation is added as a service within the DXP. The two options are provided to ensure the burden doesn’t solely fall on institutions, many of which are under-resourced.

Once the data is in the SDE, the rest of the process works through five steps:

  1. Digital Rules and Contracts (E-Contracts): Before any code touches the data, both sides agree to a machine-readable “electronic contract.” This code-based agreement sets automated ground rules on the kind of model being trained, allocation of computing power, and privacy limits that must be maintained.
  2. Trusted Execution Environments: Inside the cleanroom, the data and algorithms run within isolated, encrypted memory spaces called hardware enclaves (or Trusted Execution Environments). During training, outbound internet access is cut off. Developers cannot inspect file directories, run copy commands, or view an individual’s data.
  3. Differential Privacy: As the AI model learns, mathematical noise is added to the training calculations. This allows the model to spot broad patterns (like common indicators of a disease) while making it mathematically impossible to trace any pattern back to a person’s exact record.
  4. Safety and Bias Auditing: Once the training finishes, the model goes through automated verification and independent checks to ensure it hasn’t accidentally memorised sensitive data, developed harmful biases, or created security vulnerabilities.
  5. Model Export: After passing these checks, the developer is allowed to export only the finished model weights or performance scores. The cleanroom session is immediately wiped, and the raw dataset remains locked in its source repository.

While the cleanroom design can technically solve the privacy puzzle, it has its limitations in practice. First is the trade-off between privacy and accuracy. Adding mathematical noise protects individual identities, but too much noise can degrade model performance. Second is the more fundamental problem of the reality of raw data in India. Most records in district hospitals and state departments are undigitised and/or unstandardised. Including such institutions in this process would require rigorous digitisation and standardisation of data, capacity for which is extremely limited. In the current scenario, this framework risks being limited to adequately funded institutions, which brings us back to the question of whose data these models are trained on and who gets excluded.