Country brief · Updated August 13, 2026
Using a VPN in India
Is using a VPN legal in India?
Legal, with restrictions on use. VPN use is legal, but a 2022 directive requires VPN providers operating in India to retain customer records for five years — several providers removed their Indian servers rather than comply.
Legal, with restrictions on use
What actually matters here
A provider incorporated outside India with an audited no-logs position, so the retention directive does not reach it.
Most country pages on the web recycle the same global ranking with a place name attached. This one filters on the capability that the situation in India actually calls for, which is why 4 of our 4 providers qualify rather than all of them.
Highest-scoring provider that meets it: Proton VPN, 90.0/100.
Visit Proton VPNWe earn a commission if you subscribe through this link. It does not change Proton VPN’s score.
The legal position
CERT-In directions issued in 2022 require VPN, cloud and data-centre operators to retain subscriber names, addresses, contact details and IP allocation records for five years. The obligation is written to reach any provider serving users in India, whether or not it has infrastructure there — enterprise and corporate VPNs are carved out. It binds providers, not users, and using a VPN remains lawful.
This is a summary of publicly reported regulation, not legal advice. Rules in this area change without much notice and enforcement varies. If the consequences of getting it wrong are serious for you, check the current position locally.
What the network does
Blocking is applied to specific sites and applications under IT legislation, and regional connectivity shutdowns have been used during unrest. VPN protocols themselves are generally reachable.
Retention and logging
This is the decisive factor. Providers that kept physical Indian servers had to accept a five-year logging obligation. Several instead withdrew and now serve Indian addresses from virtual locations abroad, which keeps the no-logs position intact but places the server outside the country. A further framework was reported in 2026 — a local office, a named compliance officer, five-year subscriber records and criminal liability — but it has not been notified, so treat it as proposed rather than in force.
Providers that meet the requirement
| # | Provider | Based in | Protocols | Score |
|---|---|---|---|---|
| 1 | Proton VPN | Switzerland | WireGuard, OpenVPN, IKEv2, Stealth | 90.0 |
| 2 | NordVPN | Panama | NordLynx (WireGuard), NordWhisper, OpenVPN, IKEv2 | 84.0 |
| 3 | PureVPN | British Virgin Islands | WireGuard, OpenVPN, IKEv2 | 70.0 |
| 4 | FastestVPN | Cayman Islands | WireGuard, OpenVPN, IKEv2 | 55.0 |
Sources
Questions
- Is using a VPN legal in India?
- Legal, with restrictions on use. CERT-In directions issued in 2022 require VPN, cloud and data-centre operators to retain subscriber names, addresses, contact details and IP allocation records for five years. The obligation is written to reach any provider serving users in India, whether or not it has infrastructure there — enterprise and corporate VPNs are carved out. It binds providers, not users, and using a VPN remains lawful.
- Which VPN works best in India?
- Proton VPN on the requirement that matters here: a provider incorporated outside india with an audited no-logs position, so the retention directive does not reach it. 4 of 4 providers in our dataset meet it.
- Does the network block VPN traffic in India?
- Blocking is applied to specific sites and applications under IT legislation, and regional connectivity shutdowns have been used during unrest. VPN protocols themselves are generally reachable.
- Are there logging or retention rules that affect me in India?
- This is the decisive factor. Providers that kept physical Indian servers had to accept a five-year logging obligation. Several instead withdrew and now serve Indian addresses from virtual locations abroad, which keeps the no-logs position intact but places the server outside the country. A further framework was reported in 2026 — a local office, a named compliance officer, five-year subscriber records and criminal liability — but it has not been notified, so treat it as proposed rather than in force.