India is the second-largest market for VPN, with 45% of internet usage happening through VPN. There are few VPN service providers in India includes Surfshark, NordVPN, ExpressVPN, PureVPN, CyberGhost and IPVanish.

The Government’s new directions mandating all VPN providers and a few other entities to collect and hold user data for five years or more has sparked a debate in the cybersecurity community. Due to the pandemic, more individuals are working from home, which has increased the number of VPN users in the country. VPNs are used for various purposes, including securely connecting to workplace networks while working from home, accessing geo-restricted material, and just remaining anonymous. India had over 270 million VPN users in 2021, accounting for around 20% of the population. This figure is almost certainly higher now. The new guideline will impact the users as the VPN providers have no option but to leave the country. Essentially, one of the key benefits and use cases of VPNs – anonymity – will be eliminated. According to the directive of The Indian Computer Emergency Response Team (CERT-In), the country’s cyber watchdog, has issued the directive. The new standards will take effect sixty days after they are published, which is towards the end of June. CERT-In can request this information from these service providers at any moment. Failure to provide the data will result in penalties under the Information Technology Act of 2000 and other applicable legislation.

The directions from MeitY has asked all the VPN providers to collect and record validated names of subscribers, IPs allotted to them, IP addresses, email addresses, validated addresses, contact numbers, and ownership patterns for 5 years or longer even after the customer has cancelled the registration. Corporate VPN providers have been exempted from this.

The cybersecurity directions were issued by the Government of India as part of its policy goals of safety and trust in th.