KERALA RISING · FROM EXPORTING PEOPLE TO EXPORTING IDEAS 22. Ethics, consent, and the law A civic AI that the public does not trust is worse than none, because it discredits the idea for a generation. This chapter sets out the legal and ethical floor the institution is built to stand on; not as aspiration, but as binding constraint. Every program in this book asks citizens to let an institution observe and record a civic action. That is a privilege, not a right, and it has to be earned and re-earned through conduct that is lawful, consensual, transparent, and fair. This chapter states the standard plainly, grounds it in the law that now governs personal data in India, and names the lines the institution does not cross. It is placed late in the book : a reader who has seen the whole machine is best placed to judge whether its ethics are adequate to its reach. The claim is that they are, and that the ethics are designed in rather than bolted on. The legal floor: the DPDP Act and Rules India now has a comprehensive personal-data law. The Digital Personal Data Protection Act, 2023 received assent on 11 August 2023, and the Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025, operationalising the regime on an eighteen-month phased timeline. The Act [13] 292