Virtual Private Networks (VPNs) remain legal to use in India, but they function under strict regulatory oversight. The Information Technology Act, 2000, provides the legal framework, while the Indian Computer Emergency Response Team (CERT-In) issues specific operational directives. Although the government has not banned VPNs for general users, the privacy landscape has shifted significantly due to new cybersecurity mandates. These rules aim to enhance national security but inevitably affect the anonymity typically associated with VPN services (2).
In April 2022, CERT-In announced significant directions to strengthen the country's cybersecurity posture. These guidelines require Virtual Private Network service providers to register and maintain comprehensive user data. Specifically, providers must store validated names, physical addresses, contact numbers, and IP logs of their subscribers for a mandatory period of five years. This data retention requirement applies even after a user cancels their subscription, ensuring that law enforcement can access historical records if necessary for investigations (1).
"To address the identified gaps and issues so as to facilitate incident response measures, CERT-In has issued directions relating to information security practices, procedure, prevention, response and reporting of cyber incidents under the provisions of sub-section (6) of section 70B of the Information Technology Act, 2000."
The enforcement of these directions caused a major shift in the industry. Leading global VPN providers, including NordVPN and ExpressVPN, removed their physical servers from Indian soil to avoid complying with the data logging mandates. Instead, they now offer "virtual" Indian locations hosted on servers in countries like Singapore. This allows them to provide Indian IP addresses to users without subjecting their infrastructure to the direct jurisdiction of India's data retention laws (2).
Source:
https://www.pib.gov.in/PressReleasePage.aspx?PRID=1820904
https://cyberpeace.org/resources/blogs/vpns-explained-how-they-work-and-the-policy-status-in-india
Last updated: 11-01-2026 Disclaimer: This article does not provide legal advice. If you need legal advice, please contact an attorney directly.
