Deepfake and AI image abuse in schools: the 2026 incident-response runbook for the Principal, the Student Welfare Coordinator and the parent on the receiving end

A WhatsApp message arrives at 9:47pm on a Tuesday. It is a parent of a Class 9 pupil at a well-run CBSE school in Pune, writing to the Student Welfare Coordinator. The parent has just seen an AI-generated image of her daughter circulating in a 40-person class WhatsApp group. The image is sexualised. The parent is in shock, and so, within 10 minutes, is the Student Welfare Coordinator, who calls the Principal, who sits in silence for 30 seconds before saying "we have never had to do this before, and we have to do it right".

The next hour matters more than any other hour in the response. The first 24 hours matter more than the next 24 weeks. This piece is the operational runbook for exactly these moments. It is written honestly, for three people in the room: the parent whose child has been targeted, the Student Welfare Coordinator (the Indian-context safeguarding role at many schools), and the Principal. It is designed to be printable, foldable into a wallet, and visible on a desk; the runbook format is deliberate because when the moment comes, nobody has time to read a 3,000-word essay.

We are deliberately not making procedural claims about any specific statute. India's POCSO Act, IT Act and DPDP Act 2023 each touch different parts of a deepfake incident, and their interaction is a legal question your school's legal counsel is the right person to answer. The runbook below is operational; it works alongside statutory process, not instead of it.

Hour 0: the moment disclosure arrives

The disclosure arrives in one of three ways. The parent sees the material themselves, usually by accident, in a shared group. The targeted child shows a trusted adult (sometimes a parent, more often a teacher or counsellor they trust). A third party, often another parent, forwards the material to the school with a short note. Each disclosure route changes the first-hour sequence slightly; the principles are the same.

The first thing is the child. If the child is physically with you, say so out loud: "I am here. You are safe. Nothing about this is your fault." If the child is not physically with you (because the disclosure came from a parent or a third party), the immediate task is to get a trusted adult physically present with the child before any other action. Everything else can wait 10 minutes; the child cannot.

Believe the disclosure. Do not ask the child, in the first minutes, whether they are sure, whether they posed, whether the image is really of them. The child did not generate this material and did not consent to it. Belief is the first and non-negotiable response.

Preserve the material. Do not forward it. Do not delete it. Take a screenshot that captures the image, the sender, the group name and the timestamp (on WhatsApp, a long-press and "info" shows the sender and timestamp cleanly). If the material is on a public platform, note the URL. The screenshots stay on one device, encrypted, not shared further. The temptation to send the screenshot to a few concerned people to show them what has happened is understandable and must be resisted; every onward send is a further distribution of the material and makes the legal and takedown picture harder.

The first hour: two actions, nothing more

The first hour has two actions. The temptation to do more is strong; the discipline is to resist it until the child is safe and the material is preserved.

Action 1: child first, trusted adult present

If the child is at home, the parent stays with them. If the child is at school, the Student Welfare Coordinator or a trusted teacher sits with them, in a private but not isolated room (the counsellor's office, not a storeroom). The conversation at this point is not an interview; it is presence. "Tell me what you want to tell me, in the order you want to tell it, and if you do not want to tell me anything right now that is also fine." The child's words are not written down verbatim in this first hour; they go into the Student Welfare Coordinator's safeguarding log in summary form, with the exact wording captured only for the specific statement about the image itself if the child chooses to make one.

Action 2: preserve, do not share

Screenshots as described above. One device. Encrypted. The screenshots travel to the Principal and (if the school has one) the Data Protection Officer by secure channel, not WhatsApp forward. If the material has already been widely forwarded (which, by the time the school hears about it, is almost always the case), the preservation task also includes mapping which groups it has reached, with the Student Welfare Coordinator asking carefully worded questions of the parents who first flagged it.

Nothing else happens in the first hour. The child's immediate wellbeing and the integrity of the evidence are the only two priorities. The next 23 hours cover everything else.

The first hour is about the child, not about finding the perpetrator. The second priority is preservation of the material. Every other action, however urgent it feels, can wait until these two are in place.

The first 24 hours: four parallel streams

From the second hour onward, four streams run in parallel. The Principal is the single accountable owner; each stream has a named lead. In a small school the same person may run two streams; in a larger school each stream has its own lead.

Stream 1: school leadership informed through the safeguarding channel

The Principal is informed if they are not already. The school's existing safeguarding procedure runs end to end; a deepfake incident is a safeguarding incident with a technology element, not a technology incident with a safeguarding element. The Vice-Principal, the Chair of the governing body (if applicable), the designated safeguarding lead, and (depending on the school's structure) the Head of Senior School are informed through the normal channels, not through WhatsApp or email broadcasts.

Stream 2: formal report lodged with cybercrime.gov.in

The National Cyber Crime Reporting Portal at cybercrime.gov.in is the Indian government's primary channel for reporting cyber-crime, including the Cyber Crime Prevention against Women and Children (CCPWC) stream, which specifically covers obscene material involving minors. The report is lodged by the targeted child's parent, with the Student Welfare Coordinator present if the parent asks for support. The report includes the preserved screenshots and the mapped distribution.

Parallel to this, calling 1098 (Childline India) provides the targeted child with a trained counsellor and can route further support where appropriate. The parent is the right person to make the call; the Student Welfare Coordinator can sit alongside and facilitate.

Stream 3: legal counsel engaged

The school's legal counsel (and, separately, the targeted child's family's legal counsel if the family wants their own) is engaged within the first 24 hours. The specific statutes that may apply to any given incident are a legal question we are deliberately not answering here; your legal counsel will. The scope of the engagement in the first 24 hours is twofold: advise on the statutory reporting obligations the school has, and advise on the correct engagement with police if police involvement is appropriate.

Stream 4: platform takedown requests

Takedown requests go to every platform on which the material has appeared. WhatsApp has a reporting mechanism inside the app (long-press the message > Report); Instagram, Snapchat and TikTok each have specific "non-consensual intimate imagery" or "sexual content involving minors" reporting flows; Google and Bing have content-removal request forms. For material involving minors the platforms typically act within hours rather than days, but only if the report explicitly uses the "minor" and "non-consensual sexual" tags; the Student Welfare Coordinator should file these reports in parallel with the parent's cybercrime.gov.in report, not instead of it.

The four streams close out at or before the 24-hour mark. The child is in a safe place, the school leadership is informed, the formal report is lodged, legal counsel is advising, and platform takedowns are in flight.

Week 1: the recovery work

Week one is where the longer arc of the response begins. Four workstreams run through the week; they overlap and reinforce each other.

Pastoral support for the targeted child

The Student Welfare Coordinator schedules daily short check-ins with the targeted child in the first week. The check-ins are 10 to 15 minutes, in the same private-but-not-isolated room, and are not interviews. The child decides what they want to talk about. External counselling is offered (through the school's existing counselling partner or Childline, 1098) if the child or their parents want it; many do not want it in week one and may want it in week three; the offer stays open indefinitely. Return to classroom is handled gently; the signs-of-distress piece covers the specific behavioural signals the Student Welfare Coordinator and the class teacher should watch for.

Briefing the parent group

The parent community will have questions by the end of day two. The Principal needs to brief them before the questions turn into speculation. The briefing is carefully worded: it names the incident type without naming the targeted child, it names the response the school has taken, and it names the specific home-side steps every parent of a child in the affected class is being asked to take (delete any forwarded copies they may hold, do not reshare, support any pupil who approaches them). The briefing goes out as a formal letter signed by the Principal, not as a WhatsApp forward.

The perpetrator pathway

In most Indian school deepfake incidents the perpetrator is also a pupil, often a minor, often in the same or an adjacent year. The response to the perpetrator is both firm and trauma-informed: the behaviour is treated with the full seriousness it deserves, and the pupil is treated as a child who has done a very serious thing and needs intervention, not as an adult criminal. Identifying the originator (as opposed to onward forwarders) is almost always a police and legal matter rather than a school investigation matter; your legal counsel's guidance applies here. The school's internal pathway, once the originator is identified, involves parents, counselling, likely suspension or expulsion depending on the school's code of conduct, and continuing engagement with the child's mental-health needs. We are deliberately not making a procedural claim about the specific statutory process; the referral maps for minors in India involve the Child Welfare Committee, the Juvenile Justice framework and (where applicable) the specific child-protection statutes your legal counsel can advise on.

The classroom plan

The class or year group needs a short, direct conversation led by the Student Welfare Coordinator or a trained teacher. The conversation names what happened in general terms, names what the school has done, and names very clearly that onward forwarding of any such material is itself a serious act. The conversation is not a lecture about deepfakes; it is a frame-setting for how the class moves forward together. The targeted child's name is never mentioned.

Week 2 and beyond: the quiet rebuilding

From week two onward, the acute response gives way to a longer rebuilding. The pastoral check-ins may continue weekly rather than daily. The platform takedowns are followed up (platforms sometimes miss onward re-uploads; a monthly check through month three is sensible). The school's technical defences are reviewed: have the SafeAnywhere Browser filters caught any further related material, has the Guard app flagged any devices that are hitting generative-image sites regularly, has the school's safeguarding log picked up any adjacent concerns.

The targeted child's return to full normal is the north star. Normal is not pretending the incident did not happen; normal is the child being able to attend class, use the systems, join the friendship group and plan the future without the incident defining their day. Most schools and most families reach this point within a term with the right response in weeks one and two; some take longer, and the right response is to let the child set the pace.

Three things this runbook explicitly does not do

• Does not make statutory claims. We say what to do operationally; we do not say which section of which Act applies. That is a legal question that varies with the specifics of each incident and is answered by legal counsel, not by us.
• Does not promise detection by technology. SafeAnywhere's filters catch many sites that generate or host such material; the detection of a specific incident is almost always via human report, not algorithmic flag. Any claim of "AI detects deepfake abuse automatically" would be dishonest; the honest story is layered defence plus human reporting.
• Does not identify the perpetrator for you. That is a police and legal process. The school's role is to preserve evidence, support the targeted child, inform the community appropriately, and engage with the police investigation when invited to.

Common questions schools and parents ask about deepfake incidents

How common are these incidents in Indian schools in 2026?

More common than most schools realise, less common than headlines suggest. Our informal count across the schools we work with and talk to is that mid-sized to large Indian schools (1000+ pupils) see one serious incident of this type every 12 to 24 months, with smaller incidents (less serious but still requiring response) more often. The 2025 and early-2026 proliferation of easy-to-use AI image generators has clearly shifted the frequency curve upward, and the honest view is that the frequency will continue to rise before it falls.

What should a school do before an incident ever happens?

Three things. One, make sure the Student Welfare Coordinator role is named, resourced and trained. Two, make sure the IT lead and the Student Welfare Coordinator have the weekly Monday handshake running, because the signals that precede an incident often sit in the technical log and the pastoral log and make sense only when read together. Three, pre-draft the parent-community letter template so when it is needed it only has to be filled in, not written from scratch.

What should a parent do before an incident ever happens?

Have the conversation with your child early that if anyone ever makes an image of them that they did not consent to, your reaction will be belief and support, not interrogation or shame. Children who know this in advance disclose faster, and faster disclosure is the single strongest predictor of a better outcome. The honest conversation piece covers the general shape of these pre-emptive conversations.

How does SafeAnywhere actually help in an incident like this?

Three ways, honestly. One, the SafeAnywhere Browser's filtering reduces the probability that a pupil at a paired school casually encounters generation sites that make this kind of material easy to produce; it is a reduction, not a prevention. Two, the Guard app and the schools dashboard surface the behavioural signals that often precede an incident (unusual spikes in generative-AI site visits, sudden new app installs that correspond to known image-generation apps), so the Monday handshake can catch patterns earlier. Three, during the incident response the shared view between the Student Welfare Coordinator and the IT lead means the preservation and distribution-mapping work takes hours rather than days. None of this prevents every incident; the layered defence reduces frequency and makes response faster when prevention fails.

Should the police be called immediately?

A legal question we are not qualified to answer in general terms. The honest answer is: this is one of the first questions you ask your legal counsel in Stream 3 of the first 24 hours. Many incidents do involve police engagement; the timing and the specific unit depend on the specifics of the case. Reporting through cybercrime.gov.in in Stream 2 gives the police visibility; direct police contact may follow and may precede, depending on counsel's guidance.

What about the perpetrator's family?

Once the perpetrator is identified (which, again, is largely a police and legal process), the school engages with their family through its normal disciplinary channels. The posture is firm on the behaviour and compassionate on the child. The perpetrator's family is often also in shock; the response that holds the perpetrator accountable and keeps the perpetrator connected to appropriate support is almost always the response that reduces repeat incidents, which is the only outcome that matters once the targeted child is safe.

Does the DPDP Act 2023 change any of this?

Yes, mostly on the data-handling side. The screenshots, logs and distribution maps are personal data of multiple children; the school's handling of them is now explicitly a DPDP matter, which means minimum necessary retention, named purpose, auditable access. The DPDP compliance piece covers the general obligations; the specific handling of safeguarding-incident data under DPDP is a question for your legal counsel.

What if the targeted child does not want the school to know?

The hardest version of this. The child's wishes are weighty but not determining; where the material is in circulation among other pupils of the school, the school has a safeguarding obligation that typically engages regardless of the targeted child's wishes. The Student Welfare Coordinator's role is to communicate with the child about why the school is engaged, to minimise further exposure, and to respect every piece of the child's wishes that can be respected within the broader safeguarding frame. Your legal counsel's guidance on the exact threshold is important here.

The honest bottom line

The first hour is about the child. The first 24 hours are about preservation, informing leadership, formal reporting, legal counsel and platform takedowns, running in parallel. Week one is pastoral support, parent-community briefing, perpetrator pathway and the classroom plan. Week two onward is the quiet rebuilding. The runbook is deliberately printable because the moment it is needed, nobody has time to read a long essay; the operational discipline it embodies is what separates a response that leaves the targeted child intact from one that compounds the harm. We are deliberately not making procedural claims about any specific statute; your legal counsel is the right next step for the statutory mapping, every time.

Hour 0. First hour. First 24 hours. Week 1. The sequence is what matters, more than the detail.