Yes. Using a VPN is legal in India for individuals. No national law bans ordinary people from using one, and CERT-In, the government’s cyber-security agency, has stated that its 2022 VPN rules don’t cover individual citizens. Those rules apply to companies that sell VPN services to the public. They must keep identity and usage records about their customers for at least five years. Two limits apply. Anything illegal stays illegal when you do it through a VPN. And local authorities in some areas, notably several districts of Jammu and Kashmir, have issued temporary orders banning VPN use there.
This guide explains what the CERT-In directions require, who they apply to, what they mean for your privacy, why several big VPN companies removed their Indian servers, and the 2025–2026 government advisories on VPNs. We read the directions, CERT-In’s FAQs and the relevant laws on 13 November 2026. This is general information, not legal advice. If you have a specific legal question, consult a lawyer.
Key takeaways
- Legal for individuals: CERT-In’s FAQ says “Individual citizens are not covered by these Directions.”
- The rules target VPN providers that offer services to the public. Company and work VPNs are excluded.
- Providers must keep names, addresses, contact numbers, emails, IP addresses, dates of use, purpose and ownership pattern for at least 5 years. The directions don’t ask them to log your browsing.
- Penalties fall on providers that don’t comply: up to 1 year in prison and/or a fine of up to ₹1 crore since 2023.
- Illegal acts stay illegal over a VPN, and some local orders, such as in parts of Jammu and Kashmir, have banned VPN use temporarily.
- Several major VPN services removed physical servers from India in 2022 and now offer “virtual” Indian locations hosted abroad.
The CERT-In directions, in plain terms
On 28 April 2022, the Indian Computer Emergency Response Team (CERT-In) issued directions under Section 70B(6) of the Information Technology Act, 2000. Most of them apply to organisations generally: keep system logs for 180 days, report certain cyber incidents to CERT-In within 6 hours, and synchronise system clocks with government time servers. One paragraph is specific to data centres, virtual private server (VPS) providers, cloud providers and VPN service providers. It requires them to register and keep these details about their customers:
- Validated names of customers
- The period they hired the service, with dates
- The IP addresses allotted to or used by them
- The email address, IP address and time stamp used at registration
- The purpose for hiring the service
- Validated addresses and contact numbers
- The ownership pattern of the customer
These records must be kept for five years or longer after a customer’s registration is cancelled or withdrawn. The directions took effect in June 2022. For smaller businesses, and for the name and address checks by VPN providers, CERT-In extended the deadline to 25 September 2022. We found no later amendment or withdrawal on CERT-In’s site.
Who the rules apply to, and who they don’t
| Who | Covered? | What it means |
|---|---|---|
| You, using a VPN app | No | CERT-In’s FAQ says individual citizens aren’t covered |
| VPN companies offering “internet proxy like services” to the public | Yes | Must keep the customer records listed above |
| Your employer’s VPN for remote work | No | CERT-In’s FAQ excludes enterprise and corporate VPNs |
| Data centres, VPS and cloud providers | Yes | Same record-keeping duty for their customers |
The penalty for failing to follow CERT-In directions is set by Section 70B(7) of the IT Act and applies to the organisation that doesn’t comply. It was originally up to one year in prison, a fine of up to ₹1 lakh, or both. The Jan Vishwas (Amendment of Provisions) Act, 2023 raised the maximum fine to ₹1 crore from 30 November 2023. CERT-In’s FAQ says penalties are aimed at deliberate non-compliance, and that information is requested case by case rather than handed over continuously.
Does this mean VPNs in India log everything you do?
No, and this is the most common misunderstanding. The directions require providers to keep who their customers are and when and with which IP addresses they used the service. They don’t ask providers to record which websites you visit or what you do online. Many reports in 2022 said otherwise. Still, a provider that complies will hold verified identity information linked to your account, and must keep it for years. If your reason for using a VPN is privacy from your own internet provider on everyday browsing, that may not matter. If you want a service that holds as little about you as possible, read its privacy policy and check where its company and servers are based.
Why some VPN companies left India
Several large VPN providers said they wouldn’t keep identity records as the directions required, and removed their physical servers from India in 2022. In their own announcements, ExpressVPN said it would offer Indian locations routed through Singapore and the UK, Surfshark said it would use virtual Indian servers hosted in Singapore, the Netherlands and London, and Proton VPN said it would offer an Indian location through its Smart Routing from Singapore. NordVPN also withdrew its Indian servers in June 2022. These are the companies’ own descriptions, not legal rulings. Whether a foreign service with no Indian servers falls under the directions is a legal question the directions don’t settle clearly. Our Surfshark review and Proton VPN review cover those services in more detail.
A company that provides public VPN services challenged the directions in the Delhi High Court in 2022, and the government filed its response that December. We found no public report of the directions being struck down or put on hold.
Recent government actions involving VPNs
- December 2025: the Ministry of Electronics and IT (MeitY) advised VPN providers not to allow access to certain websites that expose people’s personal data.
- April 2026: MeitY told VPN providers they are “intermediaries” under the IT Act. It said they must make reasonable efforts to stop users reaching blocked betting and prediction-market sites, or risk losing legal protection for user content, noting that users were “misusing VPN services” to reach blocked sites.
- Local orders: news reports describe district magistrates in several Jammu and Kashmir districts issuing two-month orders banning or suspending VPN use during 2024–2025, citing security concerns. These are local and time-limited, so check for current orders if you live in or travel to such an area.
These actions don’t make VPN use illegal nationally. They show that using a VPN to reach sites the government has blocked, or to do anything unlawful, can get you into trouble, as the act itself would without a VPN.
How the data protection law fits in
The Digital Personal Data Protection Act, 2023 gives people rights over their personal data, including asking for it to be erased. The Act allows companies to keep data where another law requires it, which covers CERT-In’s record-keeping. It also exempts processing for preventing and investigating offences. The DPDP Rules, 2025 were notified in November 2025 and are being phased in over the following months. In practice, a VPN provider can lawfully keep the records CERT-In requires even if you ask for your data to be deleted.
Using a VPN legally in India: practical points
- Fine: using a VPN for privacy on public Wi-Fi, connecting to your work network, protecting your traffic from your internet provider, or reaching your own home network remotely. Our guide to whether public Wi-Fi is safe explains when a VPN helps.
- Not fine: using a VPN to commit fraud, harass people, access illegal content, or reach sites the government has blocked, such as banned betting platforms. The VPN doesn’t change the legality of the act.
- Check local orders if you are in an area under security restrictions.
- Read the provider’s policy: know where the company is based, what it records and whether it has Indian servers.
- Be wary of free VPN apps that may collect and sell your data, and install apps only from official app stores.
Frequently asked questions
Is it illegal to use a VPN in India?
No. Using a VPN is legal for individuals in India. CERT-In’s 2022 rules apply to VPN service providers, not to people who use them. Local temporary orders in some areas, such as parts of Jammu and Kashmir, are an exception.
Can I go to jail for using a VPN in India?
Not for simply using one. The penalty in the CERT-In directions applies to organisations that don’t comply. You can face legal action for illegal activities, whether or not you use a VPN.
Do VPNs in India record my browsing history?
The CERT-In directions don’t require it. They require providers to keep identity, contact, dates, IP addresses and purpose of use for at least five years.
Is my office VPN affected?
No. CERT-In’s FAQ says enterprise and corporate VPNs used by organisations are not covered by the VPN provider rules.
Why don’t some VPNs have Indian servers anymore?
Several providers removed physical servers from India in 2022 rather than keep the required customer records, and now offer Indian locations hosted in other countries.
Are any VPN apps banned in India?
Reports say government blocking orders in 2025 removed thousands of apps, including some VPNs, but no official list has been published. Install VPN apps only from official app stores and reputable providers.
The short version
Using a VPN is legal in India. The rules fall on VPN companies, which must keep customer identity records for five years, not your browsing history. Don’t use a VPN to do anything illegal or to reach blocked sites, check for local orders where you are, and choose a provider whose privacy policy you understand. This guide is general information. For advice on your own situation, speak to a lawyer.
