Cyber Bullying and Schools: Duties and Liability in India

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Cyber crime

Cyber bullying is not a school discipline problem that the law leaves to teachers. In India it is conduct that can be charged as a criminal offence under the Bharatiya Nyaya Sanhita, 2023 and the Information Technology Act, 2000, and a school that knows about it and does nothing can find itself answering for its own failure. The offence usually charged against a student who stalks or intimidates another online is section 78 of the BNS 2023, with section 351 for criminal intimidation and section 356 for defamation available where the facts fit.

For a school, the question is not whether it caused the bullying but whether it met its duty once it knew. That duty now has a statutory edge: the Protection of Children from Sexual Offences Act, 2012 makes reporting mandatory in the cases it covers, and the school's handling of student data is governed by the Digital Personal Data Protection Act, 2023. This guide sets out the offences, the school's obligations, what to do first, and where liability actually lands.

What counts as cyber bullying, legally

There is no single offence called cyber bullying in Indian law. The conduct is charged under whichever provision fits. Persistent following or monitoring of a person, including through the internet, is stalking under section 78 of the BNS 2023. Threats sent by message are criminal intimidation under section 351. Repeated insult intended to provoke a breach of the peace falls under section 352, and damaging a reputation through online statements can be defamation under section 356.

Where images are involved the law becomes stricter. Watching or capturing a person in a private act without consent is voyeurism under section 77 of the BNS 2023, and the IT Act adds its own offences: identity theft under section 66C, impersonation to cheat under section 66D, violation of privacy under 66E, and publishing obscene material under section 67. These are not overlapping labels for the same act; each has to be applied to the facts.

The offences that usually apply

Where the target is a child and the material is sexual, the analysis moves to the Protection of Children from Sexual Offences Act, 2012. Sections 13 to 15 deal with the use of a child for pornographic purposes and with the storage of such material, and those provisions apply regardless of who the offender is, including another child.

The school's legal position

A school is not ordinarily the person who commits the bullying, but it can be liable in three ways. It can be negligent, in failing to act on what it knew or should have known. It can be vicariously responsible for the conduct of its staff where an employee participates or fails in a duty. And it can be exposed under its data obligations if it shares information about the incident, or about the children involved, without a lawful basis.

The standard a school is measured against is reasonableness: did it have an anti-bullying policy, was it known and applied, did it respond promptly once told, and did it protect the victim while the matter was investigated. A policy in a drawer does not answer those questions.

What a school must do, step by step

1. Protect the child first. Arrange counselling and, where the conduct threatens safety, separate the children involved.
2. Record the complaint in writing, with the date, the platform and, where possible, screenshots that identify the account.
3. Preserve the evidence. Do not delete messages or posts; capture them and keep a copy that is not dependent on a single device.
4. Report to the police where the conduct is an offence, or where it involves sexual material concerning a child, where reporting is mandatory.
5. Notify the parents of both the victim and the child accused, separately and without disclosing unnecessary personal data.
6. File on cybercrime.gov.in, or dial 1930 if money has been extracted, and help the family pursue account takedown through the platform's grievance route.
7. Record every action taken, in a form that can later be certified under section 63(4) of the Bharatiya Sakshya Adhiniyam, 2023.

The fourth step is the one schools most often get wrong. Section 19 of the Protection of Children from Sexual Offences Act, 2012 makes reporting mandatory for a person in charge of an institution, and section 21 provides for punishment for a failure to report. A school that tries to resolve such a matter internally, to protect its reputation, is committing its own offence rather than containing the problem.

When sexual content is involved

The POCSO Act applies where a child is used for, or depicted in, sexual material. Section 15 addresses the storage of pornographic material involving a child, and the sections around it deal with the use of a child for such purposes. A circulating video or image of a school student can therefore trigger POCSO as well as the IT Act, and the school's duty to report arises immediately and does not depend on the victim's family consenting to it.

Schools should state plainly where the law is unsettled. There is continued debate about how POCSO applies to consensual teenage conduct, and about the age at which a young person's conduct should be treated as an offence rather than a welfare matter. A school facing such a case needs advice on the facts, not a general rule.

The child who bullies: age and the juvenile system

A child in conflict with law is dealt with under the juvenile justice system rather than the ordinary criminal process, with the emphasis on inquiry by a Juvenile Justice Board and on rehabilitation. That does not mean the conduct is lawful; it means the response is designed differently. For a school, the practical consequence is that reporting an offence does not automatically lead to prosecution in the ordinary sense, which is sometimes why schools wrongly assume the matter is not serious enough to report.

Student data and the DPDP Act

A school processing student data is a Data Fiduciary, and the DPDP Act treats children's data specially. Processing a child's personal data requires verifiable parental consent, and behavioural monitoring and targeted advertising directed at children are prohibited. That rule reaches conduct inside a school too: a sanctions file, a counselling record or a photograph circulated in a class group is personal data, and sharing it beyond the purpose for which it was collected raises its own liability apart from the bullying itself.

Platforms, takedown and the IT Rules, 2021

Reporting the content to the platform is a separate step from reporting the conduct to the police, and schools often confuse the two. Social media and messaging platforms are intermediaries, and under the IT Rules, 2021 they must provide a grievance officer, acknowledge complaints within the prescribed time and resolve them within the prescribed period. Their safe harbour from liability for user content under section 79 of the IT Act depends on meeting those duties, which is why a documented grievance complaint is more effective than a general report.

A school cannot rely on the platform to preserve evidence. Once content is removed it may be gone permanently, so the school or the family should capture and store what is needed before requesting a takedown. Where a fake account is involved, the platform's process for reporting impersonation runs in parallel with the police complaint, not instead of it.

Capturing evidence that will hold up

The value of digital evidence depends on how it was captured, and a screenshot on one phone is a fragile record. The person preserving it should capture the account handle, the timestamp, the platform and the surrounding conversation, and keep the original device unaltered where possible. Copies should be stored in more than one place, and the chain of custody recorded: who captured what and when.

Electronic records become admissible in court only when the certificate required by section 63(4) of the Bharatiya Sakshya Adhiniyam, 2023 is produced. A school that gathers evidence properly, and can explain where each item came from, gives the investigating agency something it can actually use.

Statutory bodies and support

Alongside the police, a case involving a child may engage the child welfare machinery, including the Juvenile Justice Board where a child is in conflict with law and the child welfare committee where a child needs care and protection. Reporting a school matter to the police does not bypass those bodies; it often brings them in. Families should also use the national cybercrime portal, and dial 1930 where money has been extracted, because that route is separate from the criminal complaint.

What decides the outcome

Three things decide where liability lands. The first is what the school knew and when, because liability for negligence begins with knowledge. The second is what the school did next, because a documented, prompt and proportionate response is the difference between a defensible decision and an indefensible one. The third is whether the school complied with the mandatory reporting duties that apply to it, because a failure to report is a separate offence that no internal settlement can cure.

For the criminal case against the offender, the deciding question is attribution: whether the account, the device and the messages can be linked to a particular person, which is why the preservation of screenshots and platform records matters so much in the first days.

What not to do

• Do not delete the offending posts or messages before they are preserved.
• Do not promise a family that the matter will be handled internally where reporting is mandatory.
• Do not circulate screenshots of the incident among staff as a general warning; that is a fresh data problem.
• Do not treat a complaint from a student as less credible because it came through a friend or a parent.
• Do not rely on a single teacher's recollection where a written record is possible.
• Do not assume the platform has removed the content because a report was submitted.

When to involve a lawyer

A school should take advice before its first serious cyber bullying case, so that its policy, its reporting line and its data practices are already sound, and again the moment a case involves sexual material, a threat to safety or a police complaint. A cyber crime lawyer in Kolkata can review the school's policy and its handling of student data before a dispute arises, and advise on the reporting duties that carry their own penalty. Where the school itself faces allegations of negligence, the guidance on criminal defence explains how such complaints are met in practice.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Cyber Security Legal Checklist for Startups in India
• Cyber Crime Compliance for Companies in India: Legal Duties
• Property Fraud Online: Duties of Real Estate Agents
• Patient Data Breach: Legal Duties of Hospitals in India
• E-Commerce Sellers: Fraud, Duties and Legal Remedies
• Data Breach Duties for CA Firms in India: What to Do

Cyber crime lawyer in your city · Bank account freeze help · Contact