Stop. Think. Then Act: What CBSE’s New Cyber Safety Circular Means for Parents and Schools

By lexEducate | School Safety & Compliance

Your child’s “online friend” from a gaming lobby says he’s 15. He’s been playing alongside your son for weeks. Tonight he asks to move the chat to a private app, and then he asks for a photo.

This happens to Indian children every day, and India’s education system has started to respond. On 8 June 2026, CBSE issued Circular Acad-39/2026, “Cybercrime Awareness in Schools”. It asks every affiliated school to bring cyber safety into the school calendar, the parent portal and the PTM. The circular’s pledge theme puts it well: “Stop. Think. Then Take Action.”

This post covers what the circular asks schools to do, what the Indian data shows, what the law says in plain language, and what parents and schools can start doing this week.

This post is general information and is not legal advice.

Why it matters now

1. The numbers are rising. NCRB’s latest Crime in India 2024 report puts crimes against children at 1,87,702, up more than 46% since 2020. Over the same period, overall crime in India fell by about 10.8% (News Bits).
2. Cybercrime against children is a growing share of that problem. In a Lok Sabha reply, the government reported a “nearly eight-fold jump” in recorded cybercrimes against children, from 232 cases in 2018 to 1,823 in 2022 (The Print). For 2024, NCRB recorded 1,238 cases under the IT Act. Nearly 9 in 10 of them involved publishing or transmitting sexually explicit material depicting children (News Sense).
3. The lower 2024 figure does not mean children are safer. Total cybercrime in India rose 17% in 2024 (Drishti IAS), and police data counts only registered FIRs. Most families never file one. Cyberbullying shows the gap clearly: only 158 cases of cyberbullying and stalking of children reached the police nationwide in 2022 (The Print), yet surveys suggest the problem affects a very large share of children.

There is also a gap between access and skills

• About 90% of rural 14–16-year-olds have a smartphone at home, and 76% used social media in the survey reference week (ASER 2024, Pratham) (Deccan Chronicle).
• Among those social media users, only 62% knew how to block or report a profile and only 55% knew how to make a profile private. Girls showed lower safety awareness than boys (Ideas for India).
• In a Local Circles survey of urban parents (Nov–Dec 2025), about 2 in 3 said their child aged 9–18 is addicted to social media, videos or online gaming (The Week/PTI).
• In a 2022 commercial survey by McAfee, 85% of Indian children reported having been cyberbullied, the highest of the ten countries surveyed (Channel Drive). The data is from 2022 and was self-reported, but the gap between that figure and police records is hard to ignore.

Children are online almost everywhere, many lack basic safety skills, and most harm is never reported. Schools can help close that gap, and CBSE has now asked them to.

What CBSE has asked schools to do

Circular Acad-39/2026 links schools to the Indian Cyber Crime Coordination Centre (I4C) under the Ministry of Home Affairs. Schools are asked to:

• Promote the I4C 2.5-hour cyber hygiene certificate course to students, teachers and parents. It is available on the homepage of i4c.mha.gov.in.
• Circulate a Cyber Safety Pledge for parents to sign. It covers safe online practices, responsible use of social media and basic cyber hygiene.
• Post cyber awareness advisories on parent portals, including the MHA cybercrime-awareness comic book, the Cyber Dost handles and the cyber safety “Snake & Ladder” game.
• Set up Cyber Clubs that run monthly activities on Cyber Jagrookta Diwas, the first Wednesday of every month. Suggested activities include quizzes, debates, poster-making, pledge drives and awareness sessions.
• Include cyber awareness in annual events and parent-teacher meetings.
• Share I4C information, education and communication (IEC) material from i4c.mha.gov.in/awareness.aspx.

National coverage of the directive confirms these elements (Outlook India; Deccan Chronicle). Cyber Jaagrookta Diwas is an existing MHA initiative that also runs in colleges and local bodies (CIET-NCERT), so schools are joining a national effort that is already under way.

The circular is written in advisory language (“encourage”, “advise”). A school that does the minimum and one that builds a real culture of cyber safety will still look very different to parents.

The risks, in Indian terms

Indian police and experts keep seeing the same patterns (ETV Bharat):

• Grooming in online games. An adult plays alongside a child for weeks, pretends to be a peer, and then moves the conversation to private messaging.
• “Free diamonds, skins or top-ups.” Children are sent to fake customer-care numbers or malicious apps or asked for OTPs and bank details. Sometimes they are asked to pay a small “verification fee”.]
• Sextortion. Fake profiles persuade a child to share a photo or join a video call. The call is recorded and used for blackmail.
• Coercion. The offender threatens to get a game account blocked or to share private chats with classmates.

Children’s devices can also expose the whole family. A parent’s UPI may be linked to a game wallet, or a “free reward” link may install malware. Separately, “digital arrest” scams, which mainly target adults and elders, cost Indians Rs 1,935 crore in 2024 (Inc42). Talk about cyber safety as a household issue, not only a children’s issue.

Warning signs to watch for (NSPCC; ETV Bharat):

• secrecy about devices or online contacts
• a sudden change in how much time they spend online
• pressure to move chats to private or encrypted apps
• unexplained gifts or in-game currency
• repeated requests for money
• anxiety when the phone or console is taken away
• withdrawal or low mood

Many of these can look like normal teenage behaviors, so pay most attention to sudden changes that have no explanation.

What the law says, in plain language

India has a layered legal framework. In plain terms:

The IT Act, 2000 makes it an offence to steal someone’s password or digital identity (s.66C), to cheat by impersonation online (s.66D), and to capture or share images of a person’s private areas without consent (s.66E). Each carries up to three years’ imprisonment (SS Rana & Co.). Section 67B deals specifically with sexually explicit material involving children. A first conviction carries up to five years and a fine of up to Rs 10 lakh, and repeat offences are punished more severely (SS Rana & Co.).

The POCSO Act, 2012 covers sexual harassment and exploitation of children, including acts done through digital means. It also places a duty to report on adults who learn of an offence. In AAA v. Linda Sema (9 July 2026), the Supreme Court held that a school staff member who receives a credible complaint directly from a child must report it to the authorities and may not run an internal “verification” first. Failure to report is punishable under s.21 with up to six months’ imprisonment, a fine, or both (Live Law). This applies to disclosures of online grooming and sextortion too. Schools should treat it as the most important legal development of the year.

The Bharatiya Nyaya Sanhita (BNS) has replaced the IPC. It covers stalking (including online stalking), criminal intimidation, extortion and defamation, all of which can apply to cyberbullying and sextortion.

The Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025 will change how children’s data is handled. Once in force, organizations must obtain verifiable parental consent before processing data of anyone under 18. They must not process data in ways that harm a child’s well-being, and they must not track, behaviorally monitor or target advertising at children (ELP Law). Breaches can attract penalties of up to Rs 200 crore (same source). These children’s provisions take effect on 13 May 2027 and are not yet in force (AZB & Partners). Schools have a narrow exemption for tracking or monitoring students for education or safety (dpdpa.com). The exemption does not cover marketing, commercial sharing with vendors, or student photos used in promotions. Ed-tech companies are not “educational institutions” and will need their own compliance. Use the months before May 2027 to prepare.

A parents’ checklist

Research on parenting supports one simple rule: controls manage time; conversations manage risk. A meta-analysis of 52 studies found that restrictions mainly reduce screen time, while talking with children and using media together does more to reduce online risks (Chen & Shi, 2019).

• Talk early and often. Ask what games and apps they use and who they play with. Explain that an online teammate is not automatically a real friend.
• Promise you won’t punish them for telling you. Children hide problems when they fear losing their phone.
• Follow age-appropriate screen limits. The Indian Academy of Pediatrics recommends no screens under age 2, up to 1 hour of supervised screen time at ages 2–5, and under 2 hours at ages 5–10 (IAP via WHO SEARO). For teenagers, agree on rules together.
• Set up the basics together: private profiles, strong passwords, the block and report buttons, and parental controls on phones and consoles.
• Never let your UPI or card be linked to a child’s game account, and teach them that no genuine company ever asks for an OTP.
• Sign the CBSE Cyber Safety Pledge with your child and use it as a family agreement.
• Take the I4C 2.5-hour course yourself and follow CyberDost (@CyberDost on X; CyberDostI4C on Instagram and Facebook) (Morung Express).
• Download free NCERT guides for parents in English, Hindi and Urdu (CIET-NCERT).

A schools’ checklist

Use the circular as your starting point and build a proper safeguarding framework on top of it:

1. Adopt a written online safety policy. Structure it around the “4 Cs” of risk: content, contact, conduct and commerce (NSPCC).
2. Name a designated safeguarding lead who is responsible for online incidents.
3. Set acceptable use policies for students and staff, along with a phone-use policy.
4. Set up a Cyber Club with a 12-month Cyber Jagrookta Diwas calendar. CIET’s themes, such as safe gaming, responsible digital citizenship and digital wellbeing, are ready to use (CIET).
5. Enroll staff in the I4C course and track how many complete it.
6. Circulate the parent pledge and keep a record of signed copies.
7. Post I4C material (comic, game, CyberDost) on the parent portal and notice boards and add a cyber safety slot to every PTM.
8. Write a POCSO-compliant reporting protocol. Any credible disclosure goes straight to the police or the Special Juvenile Police Unit, with no internal verification first (Linda Sema).
9. Add a protocol for deepfakes and AI-generated images. UK safeguarding guidance now treats these explicitly as safeguarding concerns (tutor2u on KCSIE 2026).
10. Map student data flows and review vendor contracts before the DPDP children’s provisions take effect on 13 May 2027.

What to do if something goes wrong

If your child, or a student, is being blackmailed, scammed or harassed online:

• Stay calm and reassure the child. The blackmailer is to blame, not the child (NCMEC).
• Do not pay. Paying rarely stops the blackmail (NCMEC).
• Preserve evidence. Do not delete the chats or the profile. Take screenshots of messages, usernames and transaction details.
• Do not forward any intimate images, not even to show someone as “proof”.
• Block and report the account on the platform.
• Call 1930 or file a complaint at cybercrime.gov.in. On the portal you can upload evidence and track your complaint (Morung Express). Act quickly in financial fraud cases.
• Remove images. If an intimate image was taken when the child was under 18, use Take It Down (takeitdown.ncmec.org). It creates a digital fingerprint of the image on your device without uploading the image itself. It has a Hindi option.
• Schools: report any disclosure of sexual exploitation to the police without delay. Under POCSO, this is a legal duty.

How lexEducate can help

CBSE’s circular is a good first step, but a Cyber Club alone does not protect children. They also need a policy, trained staff, a clear reporting path and parents who know what to do. lexEducate helps schools build cyber safety policies, set up and run Cyber Clubs, train staff, and put POCSO-compliant reporting protocols in place, along with DPDP readiness ahead of May 2027.

If your school wants to go beyond ticking boxes, get in touch with lexEducate.

Thanks, and Regards

Adv. Sandigdha Mishra

Founder

lexEducate

https://lexeduone.com/ "BE AWARE- Educate Regulate Elevate"