VPNInfobaseIndia’s national cyber agency, CERT-In, issued directions on 28 April 2022 under section 70B(6) of the Information Technology Act that require VPN service providers, among others, to register and keep customer details for five years; the directions took effect on 27 June 2022. The listed details are validated names, period of hire, IP addresses allotted, the email, IP address and timestamp at sign-up, the purpose of hire, validated address and contact numbers, and ownership pattern. Several VPN companies said in 2022 that they would remove servers located in India. This page summarises public documents and press reports and is not legal advice.
What the direction says
Per SFLC.in, which quotes the direction, VPN service providers (with cloud, VPS and data-centre providers) must “register and maintain” the following for five years: “validated names of subscribers/customers hiring the services”, “period of hire including dates”, “IPs allotted to / being used by the members”, “email address and IP address and time stamp used at the time of registration / on-boarding”, “purpose for hiring services”, “validated address and contact numbers” and “ownership pattern of the subscribers / customers hiring services”.
- Date and basis. 28 April 2022, under section 70B(6) of the Information Technology Act, 2000; effective 27 June 2022 (SFLC.in).
- What it does not say. SFLC.in notes the text does not make clear whether the information is to be kept by the provider or given to CERT-In or the ministry. Earlier versions of this page described the rule as storing “usage logs” and handing data over on request; neither phrase is in the list above, so both were removed.
- Reach. We have not read how the directions apply to a provider with no servers in India. Do not read this page as saying either way.
What providers said, as reported
| Provider | What was reported | Source and date |
|---|---|---|
| ExpressVPN | Removed servers physically in India; said users “will still be able to connect to VPN servers that will give them Indian IP addresses”, located in Singapore and the United Kingdom; called the rule incompatible with the purpose of VPNs | The Hacker News, 2 June 2022 |
| Proton VPN | Removing its servers from India, and “rolled out smart routing servers” giving an Indian IP address | Business Today, 23 September 2022 |
| Nord Security (NordVPN) | Reported to have shut its systems in India | Business Today, 23 September 2022, no date given for the action |
We read no source for IPVanish, PIA or Surfshark, so none is stated here; an earlier version listed them without a source. We have not tested any provider and make no statement about how well an Indian IP address works from a virtual server.
Choosing a provider
The 2022 direction concerns what providers keep, so provider logging claims and audits matter more than a server location. Compare them in the VPN audit tracker and VPN jurisdiction explained; who owns your VPN shows the companies behind each. NordVPN’s ownership, audits and pricing are in the NordVPN review. For laws elsewhere, see the UK Online Safety Act and VPNs.
Method
Researched from SFLC.in’s quotation of the CERT-In direction (the CERT-In file itself timed out for our reader) and press reports of provider statements, read on 2 October 2026. Provider announcements were not re-read on vendor sites. Laws change; reviewed every 90 days. This is a summary of public documents, not legal advice; a lawyer qualified in Indian law is the right person for your situation. NordVPN is the one provider we earn commission on (disclosure).