2026 — the year DPDP woke up Indian schools.
A year-end timeline of what changed for Indian K-12 in 2026. What stuck. What was theatre. What stays urgent in 2027 when the Children's Data rules go live on 13 May.
April 2026. CBSE Class 3 AI becomes compulsory as a subject across every CBSE-affiliated school in India. The MoE 30-October-2025 notification took effect with the new academic year. The thirteen-hundred-odd Kendriya Vidyalayas and six-hundred-odd Navodayas inherited it automatically. APAAR ID became mandatory for CBSE exam registration in the same window. Most schools spent the prior twelve weeks scrambling to identify a Class 3 AI teacher; many did not have one until June. The mandate stuck. The implementation lagged. Sahodaya cluster meets across April and May were AI-agenda-dominated for the first time.
May 2026. The first DPDP-themed PTM rounds across Tier-1 and Tier-2 private schools. The questions parents asked were the right questions — where is the data stored, who sees it, what happens if my child types something concerning, what is the opt-out path. The schools that had a written answer to all four came out of the PTMs with parent trust. The schools that did not had a problem on the parent WhatsApp group by the weekend. The schools that were running on free ChatGPT had a harder problem and mostly did not know yet.
June through August 2026. The first generation of Indian K-12 AI vendors started showing DPAs at procurement reviews. The ones that already had Schedule IV-compliant twelve-clause master DPAs ready closed deals quickly. The ones that were still drafting in response to the first procurement reviewer's questions did not. A small number of state-board first-mover programs scaled — Karnataka's Shiksha Copilot, Chhattisgarh's Magic Bus partnership, IIT-Guwahati's Assamese-medium work — but none had cross-state national reach. CISCE began publicly monitoring student uptake of Subject 66 (Robotics and AI) at the ICSE level; first board exam under the new framework ran 23 February 2026 with a small but visible cohort.
September through November 2026. The cross-border negative list activated on 13 November 2026, twelve months after the DPDP Rules notification. The first published blocked-countries list was short and not surprising, but the principle was now operational: schools authorising vendors whose data path touched the wrong jurisdiction had a clear compliance break to surface. The vendors that had built India-resident hosting architectures from the start sailed through. The vendors that had not started buying re-architecture work that took most of Q1 2027 to complete.
December 2026. Three categories of schools are visibly differentiated by year-end. The schools that wrote their own AI policy in 2026, signed by the principal under the school's name, and shipped a parent communication in the regional language are in a defensible position for the 2027 enforcement window. The schools that bought a vendor package without first writing policy are sitting on contracts they cannot fully explain to their trustee. The schools that did neither are betting that 2027 enforcement will be slow. It might be. It might not.
What is theatre. Vendor decks that lead with "AI-powered transformation" and "future-readiness" without a DPA on page two are still common, and they are still being signed by trustees who have not asked the diligence questions. The principal at the receiving end of a 2028 enforcement letter will not be able to point at the deck and say the vendor said it would be fine.
What changes in 2027. The Children's Data rules under Section 9 go live on 13 May. Verifiable Parental Consent, the profiling ban, and the breach-notification rules become enforceable. Schools that have not yet stood up a verifiable consent flow have one quarter to do it. The first Indian Character.AI-analog case is forecast for late 2027 or early 2028 by counsel doing this work seriously. Whether that case lands at a school using free consumer AI or a school using a vendor with a proper protocol is the difference between two very different news cycles. 2026 was the wake-up. 2027 is the test.