INDIA VPN LAW AND PROVIDER RULES

Is a VPN Legal in India? CERT-In Rules and User Rights

By
Updated Oct 18, 2026 7 min read
Our Methodology Editorial Policy

Short answer: India's 2022 CERT-In cybersecurity directions do not establish a general ban on an individual using a VPN. CERT-In's own FAQ says individual citizens are not covered by those directions. The directions do place recordkeeping and cybersecurity obligations on certain service providers, including consumer VPN service providers. Other Indian laws, blocked-platform orders and local restrictions can still matter depending on what someone does online.

This guide separates ordinary VPN use from obligations on VPN companies, explains the 2022 rules, and summarizes an April 2026 government advisory. It is general information, not legal advice. The documents and official explanations below were reviewed on 18 October 2026. Laws and enforcement can change.

Contents

Is using a VPN illegal in India?

The CERT-In cybersecurity directions of 28 April 2022 regulate categories of organizations and service providers. In CERT-In's official May 2022 FAQ, question 7 specifically says that individual citizens are not covered by those directions.

That is not the same as a promise that every use of a VPN or every website accessed through one is lawful. The legality of an activity can depend on the content, service, location and applicable orders. The 2022 directions should not be described as a ban on switching on a VPN; equally, they are not a blanket exemption from other laws.

What did CERT-In require of VPN providers in 2022?

Direction No. 20(3)/2022-CERT-In was issued under section 70B(6) of India's Information Technology Act. Its paragraph (v) addresses data centres, virtual private server providers, cloud providers and VPN service providers. For covered providers, it requires maintaining the listed subscriber/customer information for five years after cancellation or withdrawal, or longer if another law requires it.

The specified information includes:

  • Validated subscriber or customer names.
  • The service-hire period, including dates.
  • IP addresses allocated to or used by subscribers.
  • Email address, IP address and timestamp at registration or onboarding.
  • The stated purpose of hiring the service.
  • Validated address and contact numbers.
  • The subscriber's or customer's ownership pattern, where relevant.

These are the categories in the direction. The five-year list does not itself say every website a VPN customer visits must be stored as a five-year browsing history. But the directions also contain separate ICT-system logging duties, including a 180-day rolling log requirement for covered organizations. Those duties should not be confused with the five-year subscriber-information list or with a consumer guarantee of no logging.

CERT-In's 27 June 2022 extension notice extended implementation of certain customer-name and address validation mechanisms until 25 September 2022. It did not repeal the underlying direction.

Do the rules apply only to VPN servers physically in India?

The direction describes obligations of covered providers; it does not state that merely choosing a VPN server outside India eliminates those obligations. CERT-In's FAQ also discusses foreign service providers and the ability to produce records when required.

Do not assume a foreign server automatically changes which laws apply to a VPN provider, removes its duties or guarantees a particular level of privacy. A provider's operations, users and the applicable legal framework matter. If a provider claims that its overseas servers place it outside Indian requirements, seek a current, documented explanation rather than relying on the server location alone.

Is a work or corporate VPN covered by the same consumer-provider rule?

CERT-In FAQ question 34 distinguishes enterprise or corporate VPNs from consumer VPN services for the subscriber-information requirement. It describes a consumer VPN service provider in terms of an internet-proxy-like service offered to general internet subscribers.

That distinction is specific to the requirement the FAQ addresses. It should not be read as saying that an employer or enterprise is exempt from every cybersecurity, reporting or recordkeeping rule.

What changed in April 2026?

On 25 April 2026, India's Ministry of Electronics and Information Technology issued an advisory addressed to VPN service providers and intermediaries. It focuses on due diligence concerning access to blocked online betting and prediction-market platforms, referring to the Information Technology Act, the 2021 intermediary rules and the online-gaming legal framework.

The advisory warns that intermediaries failing to meet applicable due-diligence duties may lose the liability exemption under section 79 and face action under relevant laws. It discusses use of VPN services to reach blocked platforms. It does not itself announce a general ban on ordinary VPN use. It also does not establish that using a VPN makes activity on a prohibited platform lawful.

What happens if a provider does not comply with CERT-In directions?

Section 70B(7) of the Information Technology Act provides consequences for covered entities that fail to furnish information or comply with directions issued under section 70B(6). Following the Jan Vishwas (Amendment of Provisions) Act, 2023, effective 30 November 2023 for this IT Act amendment, the statutory maximum fine was amended from ₹1 lakh to ₹1 crore. The provision also refers to a possible imprisonment term of up to one year, or both, for the specified noncompliance.

This is a provider/direction-compliance provision, not an automatic fine on a reader for installing or using a VPN. The exact application of a penalty to any organization or person requires current legal analysis. Do not confuse an old government FAQ reproducing the pre-amendment figure with today's amended statute.

What should a reader check before relying on VPN claims?

For an individual, the practical questions are whether the online activity itself is permitted, whether any relevant service or local order applies, and whether a VPN provider's public privacy statement accurately describes its practices. A server's location, a "no logs" slogan or a generic legality chart cannot answer those questions on its own.

For technical background, read Zend2's What Is a VPN? and VPN Security Risks guides. Browse the VPN learning library for related educational material. These resources do not replace current legal advice or independent verification of a VPN provider.

Frequently asked questions

The 2022 CERT-In cybersecurity directions do not themselves ban ordinary individual VPN use. CERT-In's official FAQ says individual citizens are not covered by those directions. Other laws and restrictions can apply to particular activities, platforms or locations.

Paragraph (v) of the 2022 CERT-In directions requires covered VPN service providers and certain other providers to maintain specified subscriber information for five years after cancellation or withdrawal, or longer when another law requires it. Separate rules address ICT-system logs.

Not automatically. The direction does not create a simple foreign-server exemption. Applicability depends on the service provider and the relevant legal framework, not solely on the location of the selected VPN server.

CERT-In's official FAQ distinguishes enterprise and corporate VPNs from internet-proxy-like VPN services offered to general subscribers for the subscriber-information direction. That does not exempt businesses from other applicable cybersecurity rules.

The MeitY advisory dated 25 April 2026 concerns due-diligence obligations on VPN providers and intermediaries relating to blocked betting and prediction-market platforms. It does not announce a general prohibition on individuals using VPNs.

Section 70B(7) concerns failure by a covered entity or person to provide requested information or comply with CERT-In directions under section 70B(6). It is not a general fine for switching on a VPN. The provision was amended in 2023; penalties must be read in their proper legal context.

Primary documents and review limits

The following sources support the distinctions in this guide:

  1. CERT-In Cyber Security Directions, 28 April 2022 - particularly paragraphs (iii), (iv) and (v).
  2. CERT-In official FAQs, May 2022 - particularly questions 7, 34, 35 and 36. These FAQs are explanatory and may include historical statutory wording.
  3. CERT-In validation timeline extension, 27 June 2022.
  4. MeitY advisory to VPN service providers and intermediaries, 25 April 2026.
  5. Jan Vishwas (Amendment of Provisions) Act, 2023, Schedule amending section 70B(7) and official commencement notification (30 November 2023).

This article does not catalogue all Indian statutes, local orders, provider compliance practices or enforcement cases. Legal advice about a specific activity or service should come from a qualified professional.