KERALA RISING · FROM EXPORTING PEOPLE TO EXPORTING IDEAS rests on seven principles; consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards, and accountability, and it requires data fiduciaries to issue standalone, plain-language consent notices, to obtain verifiable consent before processing children’s data, and to report breaches to the Data Protection Board. The institution is a data fiduciary under this Act, and it treats full compliance not as a constraint to be minimised but as the floor beneath every program. Each of the seven statutory principles maps directly onto a design choice already described in this book. [14] DPDP PRINCIP LE H OW TH E I N STI T UTI O N H O NOURS I T BY DE SI GN Consent & transparency Participation is opt-in with a plainlanguage notice; the public corpus makes processing visible. Purpose limitation Verified actions are used to run the program and report outcomes; not repurposed without fresh consent. Data minimisation The system records the fact of a verified action, not more; clinical and affiliation data are never collected. Accuracy Conservative verification, human-audited samples, and a citizen dispute path keep the record accurate. Storage limitation Personal identifiers are retained only as long as the program needs them; the open corpus is aggregated and de- 293