KERALA RISING · FROM EXPORTING PEOPLE TO EXPORTING IDEAS DPDP PRINCIP LE H OW TH E I N STI T UTI O N H O NOURS I T BY DE SI GN identified. Security safeguards Standard fiduciary security obligations apply; breach notification follows the Rules. Accountability Quarterly public audit, an annual governance review, and CAG jurisdiction make accountability structural. Exhibit 19 – The seven DPDP principles mapped to the institution’s design. Source: DPDP Act 2023 and DPDP Rules 2025 (References 13–14). Consent is the spine, not the footnote No citizen is ever enrolled by default. Every program is opt-in, every consent notice is in plain Malayalam and English, and consent can be withdrawn as easily as it was given. Where a program touches a minor, a school planting drive, a college safety challenge, the design follows the Act’s requirement of verifiable guardian consent, and the institution errs toward recording less about young people, not more. The reason for this strictness is not only legal. A loop built on coerced or unwitting participation is not a feedback loop at all; it is surveillance wearing the costume of one, and it would forfeit exactly the public trust the whole enterprise depends on. 294