Indian government mandates VPN providers to store user logs for up to five years

[Redaktion]

A new directive by CERT (Computer Emergency Response Team) significantly changes how VPN services will operate in India. Companies will now be forced to store a treasure trove of user data, including email/IP addresses, names, contact numbers and addresses for up to five years, even after a user has terminated their service.

https://www.notebookcheck.net/Indian-government-mandates-VPN-providers-to-store-user-logs-for-up-to-five-years.617585.0.html

[anan]

Wouldn't it be possible for Indian users to buy a VPN subscription for bitcoin. They could buy the service from a VPN provider that does not have a legal presence in India. They could connect to a VPN server in another country. Unless Indian government bans all VPN providers that are not officially registered in the country they would not be able to enforce their law. It would mean an extra step for Indian users in buying the service. But unless India implements a China style firewall they will not be able to control VPNs.

[Pooh Sheisty]

Indian law obviously has no jurisdiction over companies not based in India. Therefore wouldnt most VPNs be able to competely ignore this legislation? Unless they impose penalties on Indians using them, I dont see how this will work

[_MT_]

Indian law obviously has no jurisdiction over companies not based in India. Therefore wouldnt most VPNs be able to competely ignore this legislation? Unless they impose penalties on Indians using them, I dont see how this will work

Well, it's not necessarily that simple. I don't know what international law has to say about it but hypothetically, a country can decide that it is their business (their citizens and infrastructure are involved, after all), pass necessary legislation, bring charges against you, sentence you in absence and then, if you ever visit that country, you could be in for a surprise. And it gets worse, they might have agreements with other countries and demand your arrest and extradition (that doesn't concern you just at home but also on vacations, business trips, possible unplanned landings, etc.).

Probable result is that companies will either comply or refuse to do business with Indian clients, in which case they can block IPs assigned to Indian entities from their end to cover themselves (which would also impact foreigners visiting India - who might fall under the law as well). They'll just serve you a page with an apology for any inconvenience.