Picture a Class 7 student in a CBSE school in Pune. She is building a face-detection project in the AI lab. Her webcam is on, and the free web tool she is using has quietly saved her photo to its servers. The teacher is helping the next batch. Nobody told her parents, and nobody wrote down where that image went.
Today that is a lapse. From 14 May 2027 it can become a legal problem, which is why DPDP Act compliance for school AI labs belongs on your agenda this term. Not in a legal footnote. On the principal's desk.
We think most schools are preparing for the Digital Personal Data Protection Act in the wrong room. They hand it to the IT desk or the admissions office. But the lab is where a child's face, voice and project files meet cloud tools, and as AI labs arrive in Pune schools and across Maharashtra, that is where the new risk sits.
Does the DPDP Act Apply to Schools, and When Does It Start?
Yes. A school that collects digital student data is a Data Fiduciary, which is the Act's term for whoever decides why and how personal data gets used. Paper records count too once they are digitised. The government notified the DPDP Rules on 14 November 2025 and spread the obligations over 18 months, as its official factsheet explains. The duties that matter most to schools (privacy notices, verifiable parental consent, security safeguards and breach reporting) begin on 14 May 2027, counted from the date the Rules were published.
The penalty ceiling gets the headlines. The Act allows fines of up to ₹200 crore for breaching obligations around children's data. That is a ceiling, not a typical outcome, and the Data Protection Board will weigh each case on its facts. But a principal does not need to fear a ₹200 crore fine to take this seriously. One upset parent with a screenshot can do real damage in a competitive locality.
The timing is the part we find interesting. CBSE's Composite Skill Lab deadline is 22 August 2027, about 14 weeks after the DPDP duties begin. So many CBSE schools will be installing or upgrading labs in the very months the data rules switch on. If you are working through our month-by-month CSL deadline plan, add a data line to every month. Design it in now, or retrofit it later at a higher price.
What Counts as Student Data Inside an AI or Robotics Lab?
Anything that identifies a child. In a classroom that mostly means names and marks. In a lab it goes much further.
Think through a normal week. Students log in to coding platforms. Engineers photograph finished robots, often with hands and faces in frame. A Class 8 group trains a model on pictures of classmates. A drone flight is filmed for the showcase. AR/VR headsets and their apps log whatever their makers decide to log. And the lab coordinator keeps attendance, project scores and notes on who struggled with the soldering iron.
Every item on that list is personal data about a child. A traditional computer period produced almost none of it. Take a school of 1,100 students: one project photo per child per term is already over a thousand images, sitting on a phone, a shared drive or someone's cloud account.
There is good news, though. CBSE built its Classes 3 to 8 Computational Thinking and AI curriculum to work without dependence on any specific platform, as we explained in our breakdown of the CBSE resource books. A school does not have to put a Class 4 child on a cloud account to teach it. The simplest way to protect student data is to avoid collecting it. For CBSE schools, that is a sound design choice, not a compromise.
Do Schools Need Parental Consent for Lab Activities?
Under the Act, a child is anyone below 18. That covers Class 1 to Class 12, so almost every lab session you run involves children's data. Processing it generally needs verifiable consent from a parent or lawful guardian, and Rule 10 of the DPDP Rules sets out how to check that the person consenting is an identifiable adult parent.
And "verifiable" matters. Law firms advising schools say a click-through box, or one blanket line in the admission form, does not meet the standard.
There is an exemption, and schools will be tempted to treat it as a free pass. Part A of the Fourth Schedule lets an educational institution carry out tracking and behavioural monitoring of children without the usual consent step, but only where the processing is limited to its educational activities or to children's safety. Read that closely. It is a conditional carve-out, and advisers note the cover ends once data is used for something else, such as sharing it with a marketing vendor or feeding it to an analytics tool that profiles students.
So which lab activities fit inside that line? Does a face-detection project saved to a vendor's cloud count as an educational activity? What about a showcase photo posted on Instagram? We are engineers and educators, not lawyers, and we will not pretend to settle that here. Take your specific lab examples to your counsel and get the answer in writing.
This post is general information, not legal advice. Ask your school's counsel to confirm how the DPDP Rules apply to your lab.
Who Is Responsible When a Lab Partner Handles Student Data?
You are. The school decides why and how student data gets used, which makes it the Data Fiduciary. A lab partner that handles data on your instructions is typically a Data Processor.
You can outsource the lab. You cannot outsource the accountability.
Researchers at ORF point out that schools often outsource digital functions without due diligence. They argue that schools must map where student data is collected, see where it flows and renegotiate vendor contracts within the 18-month window.
That matters even more in a Lab-as-a-Service partnership than in a one-time hardware sale. When a partner runs sessions every week, it touches student data every week: attendance, progress, project work. That is fine, and it is the whole point of having an on-campus engineer. But your agreement should then say what is collected, where it lives and what happens to it when the partnership ends. We wrote about the exit problem in what happens after the vendor leaves. Data deserves its own clause in that conversation.
Put these five questions to every partner on your shortlist, including us. Our vendor selection guide covers the rest of the checklist.
- What student data will your sessions collect, and why is each item needed?
- Where is it stored, and who can access it: your engineers, your tool providers, their cloud hosts?
- How long do you keep it, and what is deleted when the partnership ends?
- If something goes wrong, how quickly will you tell the school, and will it be in writing?
- Which third-party apps touch student data, and what do their terms say about children?
What Does DPDP Act Compliance for a School AI Lab Look Like on Day One?
Nobody needs a 40-page policy to start. Six habits cover most of the risk.
Collect less. For Classes 3 to 8, run sessions without student accounts unless a task truly needs one.
Use project IDs, not names. Shared boards, scoreboards and cloud folders can say "Team Falcon" instead of a child's full name.
Keep faces out of datasets. AI projects work well on objects, hand-drawn digits and public sample datasets. If a project truly needs student faces or voices, get specific parental consent for that project first.
Treat showcase photos as a separate permission. An opt-in for each event beats a blanket yes signed in April.
Set a deletion date. Project files, logs and photos should expire at the end of the academic year unless a parent asks to keep them.
Name one owner. One person on the school side, usually the lab coordinator, keeps a one-page map of what data the lab touches.
An on-campus engineer earns their place here. Someone physically in the room can stop a Class 6 student from uploading a classmate's photo to a free web tool. A vendor who ships boxes and disappears cannot. Pair the data map with your school AI policy, because the two documents should say the same thing.
Frequently Asked Questions About the DPDP Act and School Labs
Does the DPDP Act apply to schools?
Yes. A school that collects or handles digital student data is a Data Fiduciary, and the Act also covers paper records that get digitised. Vendors who handle that data for the school are usually Data Processors, but the school stays accountable.
Who counts as a child under the DPDP Act?
Anyone below 18. For schools that means almost every student from Class 1 to Class 12, so the children's data rules apply to the whole lab programme, not just the primary years.
What is the penalty for breaching children's data rules?
The government's own factsheet says breaches of obligations relating to children can attract penalties of up to ₹200 crore. That is the ceiling. The Data Protection Board examines each case, and the actual amount depends on the facts.
Can a school post student project photos on social media?
Advisers list this among the most common school practices to fix, because names and images often go online without verifiable consent. Plan on getting specific parental consent for public posts, and have your counsel approve the wording of the form.
When do the DPDP obligations start for schools?
The Rules took effect in stages. Notice, verifiable parental consent, security safeguards and breach reporting apply from 14 May 2027, which is 18 months after the Rules were published.
Start With a Data Map, Not a Policy
Go back to the Class 7 student and her webcam. Nothing in that scene needed a lawyer to prevent. It needed someone to ask, before the session, where the image would go.
That is the whole job between now and May 2027. Ask the question for every tool, every project and every partner, and write the answers on one page. A lab bought for ₹20 lakh and a lab delivered at zero setup cost carry the same data duties, so the question belongs in every conversation. If you want to see how a partnership runs on campus, start with how the lab works. When you are ready to talk specifics for your school, start the conversation.