KlauvyMeitY drafts a way to train AI without sharing sensitive data
This week
the issue in briefThis week was about who stands in the middle. MeitY floated a plan in which sensitive data trains AI models inside guarded rooms, and TRAI proposed that TV makers police streaming apps. A High Court let platforms judge copyright claims, news publishers asked the Supreme Court to shield reporting from the data protection law, and Brussels accepted Temu's repair plan. Each story asks who checks the checkers.
In brief
five things to know- Draft: MeitY has published a discussion draft for letting hospitals, banks and others make sensitive data available for AI training without handing over the raw records.
- Telecom: TRAI recommends a light-touch licence for apps that stream live TV channels, with duties on TV makers and their app stores.
- Courts: the Madhya Pradesh High Court has upheld the IT Rules provision that lets platforms remove posts that infringe copyright.
- Courts: digital news publishers have challenged the DPDP Act in the Supreme Court, which has issued notice returnable on 17 November.
- Abroad: the European Commission has accepted Temu's plan to fix the risk assessment behind its €200 million Digital Services Act fine.
Cover story
the week's big developmentMeitY drafts a way to train AI without sharing sensitive data
This week MeitY's website carried a document titled "Data Empowerment and Protection Architecture (DEPA) for AI Training", marked "Draft for Discussion".1 It proposes a system, called DEPA Training, for putting data held by hospitals, banks and public agencies to work in AI development. The aim is to do this without giving the developers the raw records.2 It is a discussion draft, not a rule, and nothing in it binds anyone yet.
The draft starts from two uses of data. Training data builds a model's abilities, and inference applies them. India's existing DEPA, the draft says, handles the second through consent managers such as the Account Aggregator. It says that approach "addresses consented sharing for individual benefit in specific transactions" and does not suit pooling data to train models.2
The draft's answer has four parts:2
- Data providers register datasets, and developers request them under electronic contracts that check the request against the sharing rules.
- Training happens only inside a secure data environment.
- The system adds differential privacy, because the draft calls simple anonymisation inadequate for AI training.
- Independent checks on bias, security and explainability come before a model is deployed.
The draft is firm on two points. Developers must train only within approved secure environments, and in the data-sharing procedure it asks government bodies to publish, personal data "shall not be shared in raw form".2 It also places a body of participants at the centre. The governance body would be a consortium of data providers, developers, data collectives, technology providers, experts and civil society, with a central registry.3
Only models that pass this comprehensive check receive go ahead for pilot deployment and scaling.
The government's role is left loose. A "competent government authority" would set the guidelines for those checks and could suspend or revoke non-compliant activity, but the draft does not say which authority that is.3 It proposes pilots, regulatory sandboxes and incentive models such as royalties.3 The draft says it is built to align with the DPDP Act, the GDPR and the EU AI Act. It does not say how its de-identified training data would be treated under the DPDP Act.3
Why it matters: the draft tries to settle a question that today's contracts often leave open, which is how data may be used to train a model and who can check that it was. It also shows the direction of travel: a technical design, backed by a registry and a government check, in place of a new statute. As a discussion draft, its details can still change. We have not seen a comment deadline in the document, which invites "actionable recommendations" without setting a date.1
The Rulebook
new rules, drafts and circulars in IndiaTRAI recommends a light-touch licence for apps that stream live TV channels
On 26 October 2026, the Telecom Regulatory Authority of India (TRAI) released its recommendations on an authorisation framework for application-based linear television distribution (ALTD) services.4 These are apps, websites and pre-installed TV software that carry scheduled TV channels over the internet, including free ad-supported streaming television. The Ministry of Information and Broadcasting (MIB) asked for this on 15 December 2025, and TRAI received 207 comments.4 The government decides what to notify.
What it proposes. TRAI wants ALTD to be a new sub-category of television channel distribution under the Telecommunications Act, 2023. The app provider would hold the authorisation, which would run nationwide for 20 years and renew in 10-year periods. The cost would be INR 10,000 to apply and a one-time entry fee of INR 1 lakh, with no bank guarantee.4 Apps could carry only channels that hold permission or registration from the Central Government.
Who it touches. TV makers and operating system providers should ensure that only authorised ALTD apps appear on their devices and app stores. MIB would keep a master list of authorised apps, and viewing on them would count in the TV ratings system.4
Watch for: whether the government accepts the proposal to notify the terms as rules. We have worked from TRAI's release; the full recommendations are on its website.
Benchmarks
what the courts decidedMadhya Pradesh High Court upholds the rule letting platforms remove copyright-infringing posts
In Anmol Jain v. Union of India (Writ Petition 4503 of 2026), a bench of Chief Justice Alpesh Yeshvant Kogje and Justice Vivek Rusia dismissed a writ petition by an Instagram creator.5 The order carries a September 2026 date and was reported on 27 October.6 Instagram had removed his posts after copyright complaints and suspended his account.
He challenged rule 3(1)(b)(iv) of the IT Rules, 2021. That rule makes an intermediary tell its users not to share anything that "infringes any patent, trademark, copyright or other proprietary rights".7 His argument was that only a court can decide infringement.5
The court held that Instagram is an intermediary under section 2(w) of the IT Act, 2000, and that the platform may manage and control its service within the rules. It pointed to the grievance officer, who must acknowledge a complaint within 24 hours and resolve it within 15 days, and to a further appeal. The provision could not be called ultra vires, it held, and his grievance lay under the IT Act's remedies.5
News publishers ask the Supreme Court to shield journalism from the DPDP Act
On 27 October 2026, the Supreme Court reportedly issued notice on a petition by the Digital News Publishers Association (DNPA), which groups the digital arms of 21 news organisations.8 A bench led by Chief Justice Surya Kant issued notice on the petition and on the application for a stay, returnable on 17 November. Issuing notice is not a ruling on the merits.
The petition, under Article 32 of the Constitution, asks the Court to strike down several DPDP Act sections, including 7, 17(2), 36 and 37, and rules 16, 17 and 23 of the DPDP Rules. Its main complaint is that the Act has no specific exemption for journalism.8 Senior Advocate Madhavi Divan reportedly told the Court that "newsrooms will shut down if we have to ask for permission".
The petition also targets section 36, which says the Central Government may require the Data Protection Board, a data fiduciary or an intermediary to furnish "such information as it may call for". Publishers argue this could expose sources.8 They also point out that section 17(2)(b) exempts research, archiving and statistical processing but not journalism.9
Watch for: the hearing on 17 November, and whether the Union offers safeguards.
Supreme Court wants penalties for misusing court videos written into MeitY's policy
On 30 October 2026, in Harshita Grover v. Union of India, the Supreme Court said action against those who misuse live-streamed hearings should be part of a policy MeitY is considering, Bar & Bench reports.10 The Court had earlier barred the unauthorised use or circulation of live-streamed proceedings on social media without prior permission, while allowing recognised news organisations to report on hearings.
The Solicitor General reportedly told the Court there had been breaches and that the Ministry was formulating a policy. The Court said the policy should include the measures for acting against those who fail to comply. Advocate Prashant Bhushan suggested that official clips carry a digital watermark and signature. Justice Joymalya Bagchi replied that the Court was working on such safeguards and that even authenticated footage cannot be commercialised.10
Why it matters: these were remarks in a hearing, and the report describes no published policy. The question of prior permission for commentators was left open.
Meanwhile, abroad
and why it matters hereBrussels accepts Temu's plan to fix how it assesses illegal-product risk
Temu is an online shopping platform where sellers list products for consumers, including in the EU, and the Commission treats it as a very large online platform.12 On 26 October 2026 it accepted Temu's action plan under the Digital Services Act (DSA), the EU law that sets duties for online platforms.11 Temu will carry out a risk analysis specific to its own platform and examine whether its recommender systems, the software that decides what each shopper is shown, amplify illegal goods. It has four months for an interim risk assessment covering the six months to 30 November 2026.11
The plan follows a Commission decision of 28 May 2026 that fined Temu €200 million. The Commission found that Temu's 2024 risk assessment rested on general e-commerce information, not evidence about its own service.12 Article 34(1) of the DSA requires very large online platforms, those with over 45 million monthly users in the EU, to "diligently identify, analyse and assess any systemic risks".13
India angle: the Madhya Pradesh order above describes the IT Rules, 2021 as built on intermediary due diligence and grievance handling. The Commission asked for something different, evidence on how a platform's own design spreads illegal goods. That is a useful yardstick if India's platform rules move from complaints towards design.
What this changes
in your contracts and policiesThe DEPA draft suggests questions for any contract that lets a counterparty train an AI model on data. Does training happen in a controlled environment or on a copy handed over, and is the data de-identified first, and by whom?2 Who may check the resulting model for bias and security, and what happens if an authority suspends the activity?3 Vague wording on these points is where the draft sees the risk. It is not law, so it is a guide to the issues, not a standard.
Further reading
worth your time this week- Section 36 of the Digital Personal Data Protection Act, 2023Vidhi Centre for Legal Policy · Blog
A student's argument that section 36 lacks a written order, notice or appeal, useful background to the publishers' challenge.
- What Training Dataset Transparency Mandates HideTech Policy Press · Essay
Argues that the dataset summaries required in California and the EU show what is inside a dataset but not how or why it was built.
- Rewriting Copyright Law for Generative AI Would Hurt EveryoneEFF · Analysis
Argues that narrowing fair use for AI training would hurt researchers and journalists, a counterweight to calls for licensing.
Between the lines
what the week adds up toRule-makers and judges reached for the same tool this week: a checkpoint placed in the middle. The checker in each case is not the state itself.
MeitY's draft puts a registry, a secure data environment and a government check between data and the developer.3 TRAI would have TV makers and operating system providers make sure only authorised streaming apps appear on their devices.4 The Madhya Pradesh High Court let a platform judge copyright claims before any court does, because the rules give users a grievance route.5 Each treats an intermediary as the place where the rule bites. In the two private-sector cases, the first stop for a complaint is the company or a grievance body, not a court. In the draft, disputes between participants would go to mediation and arbitration, still to be defined.3
The counterpoint is strong. These are different kinds of document, a discussion draft, a set of recommendations and one High Court judgment, and none is yet general law. In each, the checkpoint also carries a safeguard, such as an appeal or an independent check. And the publishers' petition shows what happens when a middle party can be asked to hand information to the state: they say section 36 does exactly that.8
This suggests the next argument will not be about whether checkpoints exist but about what protects the person on the other side of them.
What to watch
Whether MeitY names the competent authority in the final DEPA text, and whether the government notifies ALTD rules.
The paper trail
every source in this issue- Ministry of Electronics and Information Technology, Data Empowerment and Protection Architecture (DEPA) for AI Training, Draft for Discussion, posted 28 October 2026, acknowledgements page. Primary
- Ministry of Electronics and Information Technology, DEPA for AI Training, Draft for Discussion, sections 1.1 to 1.3 and 2.1 to 2.4. Primary
- Ministry of Electronics and Information Technology, DEPA for AI Training, Draft for Discussion, sections 3.2 to 3.4. Primary
- Press Information Bureau, Ministry of Communications, TRAI releases Recommendations on 'Authorisation Framework for Application-based Linear Television Distribution (ALTD) Services', Release ID 2328480, 26 October 2026. Primary
- Anmol Jain v. Union of India, Madhya Pradesh High Court (Jabalpur), W.P. No. 4503 of 2026, order, paras 5 and 7 to 10 (copy hosted by LiveLaw). Primary
- LiveLaw, Jayanti Pahwa, MP High Court Upholds IT Rules Allowing Social Media Platforms To Remove Copyright-Infringing Posts, 27 October 2026, accessed 31 October 2026. Report
- Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, rule 3(1)(b)(iv), consolidated as of 10 February 2026, MeitY. Primary
- LiveLaw, Debby Jain, 'Newsrooms Will Shutdown': Digital Wings Of Legacy Media Move Supreme Court Challenging Personal Data Protection Law, 27 October 2026, accessed 31 October 2026. Report
- Digital Personal Data Protection Act, 2023, sections 17(2)(b) and 36, MeitY. Primary
- Bar & Bench, Debayan Roy, MeITy policy should spell out consequences for unauthorised circulation of court videos: Supreme Court, 30 October 2026, accessed 31 October 2026. Report
- European Commission, Commission accepts Temu's action plan to remedy the breach of the Digital Services Act, 26 October 2026. Primary
- European Commission, Commission fines Temu €200 million for breaching the Digital Services Act, IP/26/1178, 28 May 2026. Primary
- Regulation (EU) 2022/2065 (Digital Services Act), Article 34(1); European Commission, The Digital Services Act (the 45 million monthly users threshold). Primary
Disclaimer: Klauvy Letters is intended for general information and education only. It is not legal advice or a legal opinion, and reading it does not create an advocate–client relationship. Klauvy does not provide legal services or solicit work. Readers should consult a qualified lawyer on any specific legal or factual question.