The DPDP Act is the best thing that ever happened to Indian K-12 AI.
The Digital Personal Data Protection Rules were officially notified on 13 November 2025. Substantive enforcement begins on 13 May 2027. In that eighteen-month window, every Indian school has the chance to do something they've never had: tell a vendor "no" with a law behind them.
Most schools haven't noticed yet. The rules show up at meetings dressed as compliance burden — a checklist for the trustee, paperwork for the data protection officer, one more thing the principal has to absorb between board reviews. That framing is wrong. DPDP is the first time Indian law has given a school the structural authority to say what is and is not allowed to happen with the data of a fourteen-year-old in its care. That's not a constraint. That's a moat.
Here is the architecture that matters. DPDP creates three roles. The Data Principal is the child whose data is being processed. The Data Fiduciary is the organisation that decides what happens to that data — under the educational-institution exemption in Schedule IV of the Rules, that role belongs to the school, not to the vendor. The Data Processor is the organisation that does the work on the Fiduciary's written instruction. A vendor that wants to operate inside a school operates as Processor, on the school's terms, under a Data Processing Agreement that bounds what it may and may not do. The school stays in control. The vendor does the work.
Three things change for the principal because of this. First, the school's enrolment-stage parent consent flow becomes the lawful basis for academic AI use — under Schedule IV, processing for academic activity, child safety, and clinical care does not require a separate verifiable parental consent ritual on top. Second, profiling a child for any non-academic purpose is structurally banned, and "non-academic" is defined narrowly enough that targeted ads, behavioural marketing, and third-party data sale all fall outside. Third, the penalty math is no longer hypothetical. Failure of duty regarding children is capped at ₹200 crore per occurrence. Failure of reasonable security safeguards is capped at ₹250 crore per occurrence. The press shorthand is "₹200 Cr DPDP fine"; the conservative-planning number is ₹250 Cr per incident.
This is why free consumer AI is structurally unauthorisable for under-eighteens in an Indian school, no matter how good the model gets. ChatGPT's minimum age is thirteen. OpenAI does not give the school a per-student session record, which means the school cannot satisfy its own DPDP audit-log obligation. Data is processed in the United States under US privacy law and cannot be moved there without specific consent and a future negative-list check. OpenAI's education products are teacher-only. There is no consumer-grade child-facing OpenAI product for K-12 schools, and there is unlikely to ever be one that fits Indian children's-data law cleanly.
So when a CBSE principal asks "why can't we just give the kids ChatGPT," the honest answer is: because no Indian school can lawfully authorise it for a fourteen-year-old without breaking the duty the school itself carries under DPDP. The Data Fiduciary cannot delegate its duty to a vendor that won't accept the Processor obligations. The school's duty doesn't go away because the vendor is free.
What you do with the eighteen-month runway determines everything. The three questions to ask every K-12 AI vendor on the next sales call are: show me your DPA (and a real one, with the twelve clauses Schedule IV requires); show me where my data sits (and if it leaves India, show me the consent path); show me what happens when my child types something concerning (and prove the protocol was signed off by a clinician, not a sprint).
The schools that ask these three questions before May 2027 will end up with a clean compliance posture and an AI partner that actually fits Indian law. The ones that don't will spend 2028 in remediation. DPDP is not the constraint. It is the structural reason this whole sector has to grow up.