India's VPN Rules in 2026: What the New Licensing Proposal Actually Says

What the 2022 CERT-In directive required

The directive applied to VPN providers, cloud services and data centres operating infrastructure in India. It required them to register and retain, for a minimum of five years, the name of the subscriber, the period of hire, the IP address allotted to and used by the subscriber, the email address and contact number used at registration, and the stated purpose of the subscription. It also required reporting of specified cyber incidents within six hours. The retention obligation was the sticking point. A no-logs VPN is not simply a VPN that promises discretion; it is one architected so that the data does not exist to be handed over. Retaining subscriber-to-IP mappings for five years is the opposite of that architecture — and several providers have had that claim tested, most publicly when Swedish police searched Mullvad's offices in April 2023 and left with nothing, because there was nothing to take.

Why NordVPN, ExpressVPN, Surfshark and PIA pulled their Indian servers

Rather than comply, several major providers removed their physical servers from India in 2022. NordVPN published its own explanation of the decision at the time. The practical consequence is that these providers still offer Indian IP addresses, but through what the industry calls virtual server locations: the physical machine sits in Singapore, the Netherlands or the United Kingdom, while the IP address it assigns is registered to India. Traffic is routed to look Indian; the hardware and the data it touches sit outside Indian jurisdiction. This is worth understanding clearly, because it is easy to misread as a trick. It is not hidden — reputable providers label virtual locations in their apps. But it does have real consequences. Latency is higher than a genuinely local server, because your traffic is making a round trip out of the country and back. And if your reason for wanting an Indian IP is to reach a service that checks for one, a virtual location usually works; if your reason is the lowest possible ping for gaming, it usually does not.

What changed in 2026

Two developments. In April 2026, India's Ministry of Electronics and Information Technology issued an order directing VPN providers to actively block access to banned gambling and prediction-market platforms — a shift from requiring providers to retain records towards requiring them to enforce blocks. Then, on 3 July 2026, officials confirmed that a comprehensive legal framework for regulating VPN providers is being drafted, on the stated basis that the 2022 rules had not achieved their aim. Reported elements of the proposal include requiring VPN companies to establish a physical office in India, appoint local compliance officers to act as government liaisons, and maintain subscriber records — names, addresses, contact details and IP addresses — for five years. As of this writing the framework is a draft under development, not law. Nothing described in this section currently binds any provider, and the final text may differ substantially from what has been reported. Treat it as direction of travel rather than settled fact, and check the current position before making decisions that depend on it.

What this means if you are in India

Using a VPN remains legal for individuals. The regulatory pressure described here is aimed at providers, not at users. If you are choosing a provider from within India, the questions worth asking are these. Does it operate physical servers in India, or virtual locations? If the former, it is subject to the retention directive and its no-logs claim deserves closer scrutiny. Has the no-logs claim been independently audited, and how recently? Where is the company legally domiciled, since that determines which government can compel it? And does it publish a transparency report showing what it has been asked for and what it was able to hand over? These questions are not India-specific — they are the right questions everywhere — but the Indian regulatory environment makes the answers unusually consequential.

What this means if you are outside India

Two groups of people care about this from abroad. The first are travellers, who mostly do not need to think about it: a VPN bought elsewhere works in India, and the regulatory position affects the provider rather than you. The second, and much larger, group are members of the Indian diaspora who want an Indian IP address from abroad — usually to reach a service that is only available domestically. For that use case, the virtual-server shift is the whole story: you are relying on an Indian IP that is served from outside India, and whether that works depends on whether the service you are trying to reach accepts it. It generally does; it is not guaranteed to, and no provider can honestly promise otherwise.

The honest summary

India has spent four years trying to bring VPN providers into a records-retention regime, and the providers most committed to not keeping records left rather than comply. The 2026 proposal is a second attempt with sharper teeth — local incorporation and named compliance officers are much harder to walk away from than a server rack. Whether it becomes law, and in what form, is genuinely unknown. What has not changed throughout is that using a VPN in India is lawful, and that the meaningful differences between providers are jurisdiction, audit history and transparency — not marketing claims about speed.

Frequently Asked Questions