India May Introduce New Rules for VPN Providers, Report Says
Published
Key Takeaways
- India VPN rules proposal: India VPN rules proposal could require local offices and compliance officers, but remains unconfirmed without official announcement.
- Reported government plans: The report cites anonymous senior officials, while MeitY had not responded before publication.
- No immediate user action: VPN users do not need to take action until the government releases official legislation or rules.
The Indian government is reportedly working on a new legal framework that could impose additional requirements on virtual private network (VPN) providers operating in the country. According to a report by The Indian Express, the proposal would require VPN companies to establish a local presence in India and appoint designated compliance officials to work with government authorities.
The report was published on July 3, 2026, and cites two senior government officials familiar with the matter. At the time of publication, the Ministry of Electronics and Information Technology (MeitY) had not responded to the newspaper's request for comment.
As of now, no official draft law, notification, or public government announcement has been released, meaning the reported framework has not been formally introduced.
What could change for VPN providers?
According to the report, the proposed framework is being considered because officials believe the existing 2022 Indian Computer Emergency Response Team (CERT-In) directions have not achieved their intended outcome.
The reported measures could require VPN providers to:
- Open an office in India.
- Appoint compliance officers to act as points of contact for government requests.
- Designate officials responsible for handling government grievances.
The report also says authorities are considering penalties for companies that fail to comply, including possible legal consequences for locally appointed employees. Similar compliance requirements already apply to major social media platforms under India's Information Technology Rules, 2021.
One government official quoted anonymously said authorities have observed more people using VPN services to access apps, accounts, and online content that has been blocked within India. According to the official, the existing CERT-In data retention requirements have not persuaded many VPN providers to comply, prompting discussions about a broader law.
Why privacy users should pay attention
A VPN, or virtual private network, hides a user's IP address and routes internet traffic through servers in another location. This helps protect online privacy and can also allow users to access websites or services that are unavailable in their country.
The report says the government's main concern is that VPN services are increasingly being used to bypass content-blocking measures. Officials reportedly believe requiring local offices and designated contacts would make it easier to communicate with VPN companies and enforce government directives.
The article also references India's 2022 CERT-In directions, which require VPN providers, cloud service providers, and data centres to retain certain customer information, including names, email addresses, contact numbers, and IP addresses, for five years.
Following those rules, several VPN providers, including Proton VPN, NordVPN, ExpressVPN, and Surfshark, removed their physical servers from India and instead began routing Indian users' connections through servers in Singapore.
The report also notes that Proton VPN experienced a significant increase in registrations from India after the government temporarily blocked Telegram ahead of the NEET-UG retest last month. According to the article, Proton VPN General Manager David Peterson said registrations from India rose by more than 120%, after which his post on X and his account were reportedly blocked in India.
Is the report verified, and do users need to take action?
TechNadu has confirmed that this information is based on reporting by The Indian Express, which cites anonymous senior government officials. The newspaper states that MeitY did not respond before publication, and no official government announcement or draft legislation has been released at this time.
Because the proposal has not been officially announced, there is no immediate action required for VPN users or providers. Users should treat the reported framework as a proposal under consideration until the Indian government publishes formal legislation, draft rules, or an official statement.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular