VPNs are legal in India. However, 2022 CERT-In rules require VPN providers with Indian servers to log user data. Many VPNs removed Indian servers rather than comply. Using VPNs with foreign servers remains legal and private.
Current Legal Status
| Country | India |
| VPN Status | Legal |
| Data Retention | Required for providers with Indian servers |
| Foreign Servers | Not subject to Indian logging rules |
| User Prosecution | No cases for legitimate VPN use |
Using a VPN in India is completely legal. The 2022 regulations affect VPN providers, not users. You can legally use any VPN service.
CERT-In Regulations
In 2022, India's Computer Emergency Response Team (CERT-In) introduced new cybersecurity rules:
What's Required
- VPN providers must register with CERT-In
- Store user logs for 5 years including:
- Customer names and addresses
- IP addresses (assigned and real)
- Usage patterns and timestamps
- Contact information
- Provide data to authorities on request
VPN Provider Responses
- Removed Indian servers: ExpressVPN, NordVPN, Surfshark, ProtonVPN, and others
- Virtual servers: Some offer "virtual" Indian IPs from servers in other countries
- Compliance: Some smaller providers may comply with logging
Impact on VPN Users
What Changed
- Fewer physical VPN servers located in India
- May need to connect to nearby countries (Singapore, UAE) for best speeds
- Virtual Indian servers available from some providers
What Didn't Change
- VPN use remains legal
- No prosecution of individual users
- Foreign servers not subject to Indian law
- Privacy maintained when using non-Indian servers
What Users Should Do
- Use reputable VPNs: Choose providers that prioritize privacy
- Check server locations: Use servers outside India for privacy
- Virtual Indian IPs: Available if you need an Indian IP address
- Nearby servers: Singapore, UAE for good speeds to India
Frequently Asked Questions
Yes, absolutely. VPN use is legal in India. The CERT-In rules affect VPN providers, not users. You can use any VPN service, and connecting to servers outside India means your data isn't subject to Indian logging requirements.
Possibly slightly. Connecting to Singapore or UAE servers instead of Indian servers adds some latency. However, with modern protocols like WireGuard, the difference is usually minimal for most activities.