India bets on ‘sealed rooms’ to train AI on sensitive data without exposing it

DEPA for AI is a framework for training artificial intelligence on sensitive information held by hospitals, banks, and government agencies. Its central idea is simple: bring an AI model to the data instead of sending the data elsewhere. This could make valuable datasets usable without exposing personal records.

A sealed room is a secure computing environment. It runs only the tasks allowed by an authorised digital contract. The data owner keeps the information, while the system processes it inside the protected environment. According to the launch presentation, nobody can access the data inside, including the company operating the system.

A developer sends in an AI model and receives the trained model, not the underlying records. In some cases, such as a loan application, the developer receives only the resulting decision. The framework is still not legally binding, and its contracts, payment methods, and liability rules need further development.

The developer does not copy customer or patient records to its own systems. Instead, it submits an AI model to a secure environment controlled through DEPA for AI. The model is trained using data that remains inside the bank or hospital. This could open access to useful information that institutions usually keep private.

The sealed room runs only what an authorised digital contract permits. It is designed so that even the company operating the environment cannot see the data inside. After processing, the developer receives only the trained model. For an application such as lending, it may receive just the decision produced by the model.

This arrangement separates learning from exposure. A hospital could help train a tumour-detection model without showing its MRI scans to a health-tech company. A bank could assess eligibility without handing over its customer database. The framework remains voluntary and not legally binding for now.

The largest figure reported for the early pilots was more than 2 million requests. A bank testing the framework since March 2026 used it to identify which customers of a fintech qualified for credit cards. It completed that work in two weeks, before requesting consent from people who had a real offer.

The article gives no number for the hospitals’ MRI scans, patients, or training runs. It says hospitals and a health-tech startup used the framework to train a tumour-detection model. The startup never saw the MRI scans, because the model was trained inside a secure environment holding the hospitals’ data.

These pilots show two different uses rather than one common scale. Banking demonstrated high-volume eligibility checks, while healthcare demonstrated protected model training. Both were early trials, not proof that the framework has been broadly deployed. Further pilots in finance and healthcare are planned under regulatory supervision.

DEPA could make domain-specific AI more practical in areas such as healthcare, education, critical communications, and banking. Hospitals and banks hold valuable information, but they rarely share it. If models can learn from that information without the records leaving their owners, developers may build more useful applications for specific public and commercial needs.

The banking pilot illustrates one possibility: a model identified fintech customers who qualified for credit cards before consent was requested. The framework could also support joint fraud detection across banks, addressing a collective problem that individual consent-based sharing does not solve. In healthcare, hospitals and a startup trained a tumour-detection model on MRI scans the startup never saw.

The promise depends on trust and data quality. Mozilla Foundation’s Jibu Elias said both are difficult to establish. The framework is not legally binding, and consultations, pilots, and regulatory sandboxes come next. Payment and leak-liability rules also remain unresolved, so benefits are not guaranteed.

Hospitals and banks have traditionally been reluctant to share data because sharing brings limited financial reward while creating serious risks. The article says they make little money from data and could face fines if it leaks. They also hold information belonging to millions of people, increasing the consequences of a mistake.

India’s data protection law can impose penalties of up to ₹250 crore for a leak, according to the article. DEPA tries to reduce exposure by keeping data with its owner and processing it inside a sealed room. The system is intended to stop even its operator from accessing the information.

That protection could encourage institutions to participate, but important safeguards remain incomplete. Stakeholders still need to build a trust framework and validate the quality of large sensitive datasets. The handbook does not specify who would be liable if data leaked from a sealed room, leaving a major concern unresolved.

The official presenting DEPA described it as a “democratic third way.” In the United States, companies buy data through commercial deals. In China, the state pools data. DEPA takes a different route: data stays with the institution that owns it, while authorised models run against it in a protected environment.

India already has a consent-based data-sharing framework introduced through DEPA in 2020. That system helps citizens securely share their own data with consent. The newer AI framework extends the approach to training models on sensitive data belonging to millions of people without requiring the records to leave their institutions.

The distinction is especially important for collective problems. A banking executive said the existing system solves individual consent well but cannot solve issues such as fraud spanning multiple banks. DEPA could let institutions collaborate through secure computation, although consultations, legal changes, trust rules, and liability arrangements are still pending.

Training an AI model involves showing it many examples so it can identify patterns relevant to a task. In this article’s cases, those examples could include hospital MRI scans or banking information. More data can help a model handle complex, domain-specific problems, but the records may contain sensitive personal details.

Secure computing changes where the learning happens. Instead of sending records to a developer, the developer sends its model into a sealed room. An authorised digital contract controls the permitted operation. The system processes the records inside the institution’s protected environment, then returns only the trained model or a specific decision.

This design aims to make data useful without exposing the original records to the developer or even the system operator. The article gives a tumour-detection pilot as an example: the startup never saw the MRI scans. However, the framework still needs trust, quality checks, legal rules, and clear responsibility if a sealed room leaks data.