Data Retention by VPN Providers in India

Introduction

A Virtual Private Network (VPN) is a technology that establishes a secure and private connection between a user’s device and the internet. VPNs encrypt internet traffic and hide the user’s digital identity. By connecting to a VPN server in a different location, users can access content and websites that may be restricted or blocked in their locality. When a user connects to a VPN, the data exchanged is encrypted, meaning that it is transformed by an algorithm into a form that can only be read by a sender and receiver holding a particular decryption key, and it is transferred through a tunnel to the VPN server. The last decade has seen a sharp rise in the use of VPNs by Indian internet users. This is because of the heightened need to ensure online privacy, the frequent blocking of online platforms and the frequency of internet shutdowns. With their ability to mask users’ IP addresses and provide them with overseas servers, VPNs enable users to circumvent geographical content blocks and to protect themselves online to a certain extent. But they also undermine the State’s ability to monitor and prosecute unlawful activities by tracking users.

India’s premier cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), has issued Directions by virtue of its powers under Section 70B of the Information Technology Act, 2000. That Section provides for CERT-In to serve as the national agency for performing functions in the area of cyber security, including responding to cyber incidents, and, by sub-section (6), empowers it to call for information from, and give directions to, service providers, intermediaries, data centres, body corporates and any other person.¹ The 2022 Directions were issued under sub-section (6) of Section 70B, on the stated ground that:

“it is considered expedient in the interest of the sovereignty or integrity of India, defence of India, security of the state, friendly relations with foreign states or public order or for preventing incitement to the commission of any cognizable offence using computer resource or for handling of any cyber incident, that following directions are issued to augment and strengthen the cyber security in the country”.²

Among the Directions, one particularly important provision, clause (v), requires data centres, Virtual Private Server (VPS) providers, cloud service providers and VPN service providers to “register the following accurate information which must be maintained by them for a period of 5 years or longer duration as mandated by the law after any cancellation or withdrawal of the registration as the case may be”: the validated names of subscribers, the period of hire, the IPs allotted to them, the email address, IP address and time stamp used at registration, the purpose for hiring the services, validated addresses and contact numbers, and the ownership pattern of the subscribers.³

This clause appears to have created more problems than it solved. While the Directions have been issued, not all VPN providers have complied; several global providers have instead opted to operate their servers from overseas while simultaneously offering Indian IP addresses, which Indian users continue to access.

It must be noted that CERT-In’s Directions are important in their own right. At the same time, it has been reported that CERT-In has refused to reveal the details of the compliance notices it has sent to such companies under the 2022 Directions.⁴ Given the nature of the problems CERT-In is trying to solve by invoking such far-reaching directions, it remains to be seen how these Directions will fare as India develops a more robust cybersecurity and data protection framework.

Literature review

While the literature on CERT-In’s 2022 Directions and on extraterritorial cyber-enforcement is still in its infancy, several works engage with topics connected to the issues posed by the research question.

First, Chaturvedi and Srivastava’s examination of CERT-In’s VPN rules in International Data Privacy Law is the work most closely connected to the research question of this paper, as it tackles the constitutionality of CERT-In’s data retention requirements from the perspective of India’s privacy jurisprudence, touching briefly on the issue this paper seeks to address: the limits of extraterritorial enforcement where VPN servers are maintained exclusively abroad.⁵ Other works approach the subject from different angles, providing the context necessary to understand CERT-In’s enforcement as part of a larger trend.

In particular, on the reach of extraterritorial enforcement jurisdiction, Ryngaert’s article on extraterritorial enforcement jurisdiction in cyberspace is the most informative.⁶ The tension he identifies between the volatility of data, which may be moved from one jurisdiction to another “with the click of a mouse”, and a law of enforcement jurisdiction anchored in territory is the key point with which this paper engages, and the analysis builds upon the contextual outline the article provides. Specifically, this paper is concerned with the ability (or inability) of CERT-In to assert jurisdiction over foreign-based companies using local jurisdiction as a tool, which relates to the context of the CLOUD Act (and, to a lesser extent, the EU Production Order regime), under which domestic authorities may order service providers to produce data within their possession or control regardless of where it is stored.

The literature on responses to cross-border cybercrime, while not addressing the particular issue of this paper, describes the context in which CERT-In’s enforcement efforts exist. Ryngaert’s article and this paper address similar issues from different perspectives: while the former speaks of the difficulties of gathering evidence across borders and the inadequacy of a strictly territorial approach, this paper tackles the question of CERT-In exercising extraterritorial enforcement. The limiting conditions that Ryngaert proposes for extraterritorial enforcement speak to the complications that CERT-In’s approach would face in practice, which relate to this paper’s argument on the costs associated with extraterritorial enforcement.

Lastly, on data localisation, Selby’s analysis of data localisation laws, with a particular focus on the BRICS states, provides a useful framework within which CERT-In’s data retention requirements can be read as an example of an emerging economy attempting to keep data within its reach.⁷ By treating data localisation laws as responses to cybersecurity, trade and geopolitical considerations rather than to privacy concerns alone, it provides additional context for CERT-In’s actions as part of a similar trend. In addition, Sahoo’s article on the development of India’s data protection legislation, which traces India’s data protection law from the Supreme Court’s privacy ruling to the Digital Personal Data Protection Act, provides context for CERT-In’s data retention requirements as part of India’s developing data protection framework.⁸

However, while the literature on CERT-In’s jurisdiction and data retention requirements touches upon several issues raised by this paper, most of it does not tackle extraterritorial enforcement directly, aside from the brief discussion in Chaturvedi and Srivastava’s work.

In conclusion, while the literature on CERT-In’s 2022 Directions and on extraterritorial cyber-enforcement touches on many topics related to this paper, it lacks specific analysis of the practical implications of CERT-In’s enforcement policy. This paper provides such analysis, addressing the ways in which the extraterritorial enforcement of the 2022 Directions affects CERT-In’s relationship with foreign entities.

Statement of research problem

CERT-In’s Directions dated 28 April 2022, issued under Section 70B(6) of the Information Technology Act, 2000, impose a five-year information-retention obligation on VPN service providers operating within India.⁹ Some of the world’s largest VPN services have pulled their servers from India but continue to provide Indian IP addresses to users, thereby placing themselves beyond the practical reach of Indian law.¹⁰ The issue is the reach of Indian law over these entities, as Section 70B(6) makes no provision for service providers who operate remotely without any registered office, assets or personnel in India. This paper investigates whether the Directions are a valid means of enforcing law in India, and how far that jurisdiction extends when the regulated service can be relocated to another jurisdiction.

Validity and enforceability are distinct questions, and both merit investigation; the literature on the 2022 Directions has focused largely on their constitutionality rather than on the mechanics of enforcement.¹¹ Left unanswered, the enforcement question reduces the Directions to little more than a formality for international actors who have the capacity and willingness to relocate beyond the reach of Indian law.

Research objectives

This paper aims:

1.  To explore the powers granted to CERT-In by Section 70B(6) of the Information Technology Act, 2000 and to assess whether the provision confers an express or implied jurisdiction over foreign entities that have no presence in India.

2.  To review the requirements of the 2022 CERT-In Directions, especially the data retention obligation under clause (v), and to analyse the responses of the major VPN providers to that direction.

3.  To identify the coercive measures that Indian authorities can practically take against foreign VPN providers who have no servers, offices or assets in India, and to specify where those measures fall short.

4.  To compare the U.S. CLOUD Act and the extraterritorial enforcement mechanisms adopted by the European Union in order to identify alternative regulatory mechanisms that could support India’s coercive jurisdiction over foreign entities and help secure compliance with the data retention norms of the CERT-In Directions.

Research questions

In consonance with the hypothesis and objectives discussed in the preceding section, this paper is guided by the following research questions:

1.  To what extent does the jurisdiction of CERT-In under Section 70B(6) of the Information Technology Act, 2000 extend to foreign VPN providers having no physical presence in India?

2.  How has the relocation of foreign VPN providers’ physical servers outside India, in response to the 2022 CERT-In Directions, affected the retention of Indian users’ data?

3.  What options does the Indian Government have to ensure that foreign-based VPN providers follow the data retention order issued by CERT-In despite their physical absence from India?

4.  Can the options identified under the third question offer a viable solution to the jurisdictional issues concerning data localisation, in comparison with the CLOUD Act of the United States and the extraterritorial data-disclosure powers of the European Union?

Scope and limitations

This paper restricts itself to a discussion of Section 70B(6) of the Information Technology Act, 2000 and the CERT-In Directions of 28 April 2022, to the extent that they impose data retention obligations on VPN service providers. It considers the issue in the context of foreign VPN providers who have shifted their infrastructure elsewhere while continuing to provide services to Indian users. The comparison is restricted to two regimes, the CLOUD Act of the U.S. and the extraterritorial enforcement mechanisms available in the EU, as both deal with the issue of accessing data from providers located outside the jurisdiction. The paper does not attempt an exhaustive treatment of the regulation of VPNs or of data retention laws across the world.

The study is doctrinal, based upon textual analysis of statutes, the regulator’s directions, secondary legal literature and industry commentary, rather than on empirical evidence drawn from interviews with the industry or regulators (the latter possibly being available only in non-public form).

CERT-In has not publicly released compliance data, so this paper’s discussion of enforcement outcomes rests on public reporting and on the limited information CERT-In has disclosed; the comparison is illustrative rather than exhaustive, testing the hypothesis on two regimes rather than attempting to capture every possible alternative for extraterritorial enforcement. Finally, the reported challenge to the validity of the 2022 Directions before the Delhi High Court was withdrawn without a ruling on the merits,¹² and this paper’s analysis is confined to the question of enforcement.

Research methodology

This study employs a doctrinal legal research method to address the jurisdictional and enforcement challenges involved in imposing data retention obligations on foreign VPN service providers who do not have a physical presence in India. It uses primary sources, including the Information Technology Act, 2000, the Information Technology (The Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules, 2013, the CERT-In Directions dated 28 April 2022, relevant case law and government documents, and secondary sources, including academic articles, books, journals and reports. It uses statutory interpretation of the relevant provisions, including Section 70B(6), to understand the extent and limits of CERT-In’s authority to issue directions, and a textual analysis of the 2022 Directions to explicate the obligations imposed on foreign service providers under clause (v) and the penalties under Section 70B(7) for violations. It also uses the case study method to show how the industry responded to the 2022 Directions, based on statements and reports made public by industry participants, which serves as the basis for the research problem. The study applies a comparative law methodology to examine the United States’ CLOUD Act and the EU’s extraterritorial enforcement regime, including the European Production Order, as approaches to extraterritorial enforcement and to the retention and disclosure obligations of foreign service providers. The methodology is appropriate to the extent that both the compared regimes face the same jurisdictional challenge that this paper addresses, namely obtaining compliance from a foreign service provider in another jurisdiction, and therefore offer the most relevant comparison rather than a wider survey. The comparison is narrowed to the similarities and differences that bear on the jurisdictional issues faced by CERT-In in imposing data retention obligations under the 2022 Directions. The study also relies on existing jurisprudence on jurisdiction and extraterritorial enforcement, both in India and in the compared jurisdictions, to evaluate the doctrinal viability of CERT-In’s approach.

The study is analytical and critical in nature, as it seeks to identify whether existing Indian law provides a viable mechanism for enforcing CERT-In’s directions against foreign-based entities, and identifies gaps in the enforcement mechanism, if any. As such, it relies on textual analysis of legal resources, both primary and secondary, without employing empirical methods such as interviews or surveys, which is justified by the objectives of the study as explained in the section on scope and limitations above.

Statutory framework, enforcement challenges, and comparative analysis

This part comprises the analysis of the paper. It begins with the legal basis for CERT-In’s authority under Section 70B, examines the directions issued in the 2022 notification, and explores the industry’s reaction and the courts’ engagement with the issue of jurisdiction. It then evaluates, by reference to the CLOUD Act of the U.S. and the extraterritorial regime of the E.U., whether the current Indian legal framework could successfully bring foreign VPN providers within the jurisdiction of Indian courts.

A. The statutory framework: Section 70B and CERT-In’s mandate

Section 70B of the Information Technology Act, 2000 (“IT Act”) is the statutory basis for CERT-In’s authority. This provision, inserted into the IT Act by the Information Technology (Amendment) Act, 2008, designates CERT-In as the national agency for performing functions relating to cyber security, including the collection, analysis and dissemination of information on cyber incidents, forecasts and alerts of cyber security incidents, and the coordination of cyber incident response activities. The source of CERT-In’s direction-issuing power is sub-section (6) of Section 70B, which authorises it to “call for information and give direction to the service providers, intermediaries, data centres, body corporate and any other person” for carrying out its functions under sub-section (4). CERT-In thus has a wide grant of authority, covering not merely passive information-gathering but also the issuing of binding directions compelling positive compliance. The effect of sub-section (6) is, however, tempered by the consequences for non-compliance: Section 70B(7) provides that any service provider, intermediary, data centre, body corporate or person who fails to provide the information called for or to comply with a direction shall be punishable with imprisonment for a term which may extend to one year, or with fine which may extend to one crore rupees (raised from one lakh rupees with effect from 30 November 2023), or with both. Section 70B(8) adds an important procedural safeguard: no court shall take cognizance of any offence under the section except on a complaint made by an officer authorised in this behalf by CERT-In.¹³ The implication is that enforcement of CERT-In’s directions must proceed through a specific authorised channel, and that, in practice, the entity directed must be capable of being located, physically or institutionally, within India if a court is to proceed against it.

A further question concerns the categories of entities to whom CERT-In’s directions under sub-section (6) can be issued. The language of the provision, “service providers, intermediaries, data centres, body corporate and any other person”, is broad, and does not, on its face, exclude foreign entities or require a territorial nexus with India as a precondition for a direction to be issued. The absence of an express territorial limitation is significant: it suggests that CERT-In’s authority to issue a direction to a foreign VPN provider is not legally doubtful. The more difficult question, addressed in the sections that follow, is whether a direction validly issued under this authority can also be enforced against a provider that has removed itself from any physical or institutional connection with India, a gap that the statute itself does not resolve.

B. The 2022 CERT-In Directions: scope and requirements

The Directions issued by CERT-In on 28 April 2022 (“Directions”, No. 20(3)/2022-CERT-In) were intended to augment and strengthen cyber security in the country, and became effective sixty days after their issue, at the end of June 2022.¹⁴ On 27 June 2022, CERT-In deferred to 25 September 2022 the effective date of the Directions for micro, small and medium enterprises and, for data centres, VPS providers, cloud service providers and VPN service providers, of the requirement to register validated subscriber names, addresses and contact numbers.¹⁵ The Directions place a number of obligations on a broad category of “covered entities” (service providers, intermediaries, data centres, body corporates and government organisations), although certain requirements apply specifically to data centres, VPS providers, cloud service providers and VPN service providers.¹⁶

Under clause (i), all covered entities are required to synchronise their ICT system clocks with the Network Time Protocol (NTP) server of the National Informatics Centre or the National Physical Laboratory, or with NTP servers traceable to them.¹⁷ Under clause (ii), any cyber incident of a type listed in Annexure I of the Directions must be reported to CERT-In within six hours of the covered entity noticing the incident or having it brought to its notice, a markedly shorter window than, for instance, the seventy-two hours allowed for notifying a personal data breach under the EU’s General Data Protection Regulation.¹⁸ Clause (iv) further requires covered entities to maintain logs of all their ICT systems for a rolling period of 180 days within Indian jurisdiction.¹⁹

The requirement most relevant to this paper is found in clause (v): data centres, VPS providers, cloud service providers and VPN service providers are required to register specified information about their subscribers and to maintain it for five years, or any longer period mandated by law, after any cancellation or withdrawal of the registration.²⁰ The information comprises the validated names of subscribers, the period of hire including dates, the IPs allotted to or used by them, the email address, IP address and time stamp used at registration, the purpose of hiring the services, validated addresses and contact numbers, and the ownership pattern of the subscribers. CERT-In’s FAQs confine the obligation to providers of “Internet proxy like services” to general internet users, excluding enterprise and corporate VPNs.²¹ This amounts to a Know Your Customer obligation for VPN providers, who generally do not keep such detailed information about their subscribers because of the privacy-protective character of their services, and it might cause them to lose customers who wish to make use of the anonymity offered by a VPN subscription.²²

If the Directions are violated, penal action may be taken under Section 70B(7) of the IT Act, which provides for imprisonment of up to one year, a fine of up to one crore rupees, or both. The Directions themselves add no enforcement mechanism; they rely on the penalty in Section 70B. Consequently, whilst Section 1(2) of the IT Act expressly extends the application of the Act to offences or contraventions committed outside India by any person, and Section 70B(7) provides for the prosecution and punishment of any person who fails to comply with a direction, neither provision provides any direct, practical means of enforcing compliance against a foreign entity which possesses neither physical presence, nor assets, nor personnel within Indian territory.²³ CERT-In’s own FAQs take the view, by reference to Sections 1 and 75 of the IT Act, that the Directions apply “to any entity whatsoever, in the matter of cyber incidents and cyber security incidents”, and state that service providers offering services to users in India must designate a Point of Contact to liaise with CERT-In even if they have no physical presence in the country;²⁴ the difficulty lies not in asserting that obligation but in enforcing it.

C. Industry response and the enforcement vacuum

The global VPN industry’s reaction to the 2022 Directions was quick and, from CERT-In’s point of view, largely counterproductive. Instead of accepting the registration and five-year retention requirements of clause (v), several of the world’s largest providers removed their physical server infrastructure from India. ExpressVPN was among the first major providers to announce this, on 2 June 2022, describing the new rule as “incompatible with the purpose of VPNs, which are designed to keep users’ online activity private”.²⁵ Surfshark followed on 7 June 2022,²⁶ and by the end of June 2022 NordVPN, PureVPN, Hide.me, Privado and CyberGhost had confirmed that they too had shut down their physical Indian servers.²⁷ CyberGhost publicly announced that it was removing its Indian servers because compliance would have required it to store users’ data and share it with the Indian authorities, which its no-logs policy did not permit.²⁸ Although these providers withdrew their physical servers from India, they did not leave the Indian market: most of them offered “virtual” India servers, located outside the country (ExpressVPN’s in Singapore and the United Kingdom) but configured to give users Indian IP addresses.²⁹ As a result, Indian subscribers could continue to access India-specific content and services much as before, while no data centre or server handling the connection remained on Indian territory. CERT-In’s FAQs nevertheless maintain, by reference to Sections 1 and 75 of the IT Act, that the Directions apply to any entity in the matter of cyber incidents and cyber security incidents.³⁰ The commercial relationship between the provider and its Indian subscriber base thus remained unchanged, while the regulatory relationship between the provider and CERT-In was, in practice, ended.

This exposes the main gap in enforcement that the present paper examines. The Directions issued by CERT-In were aimed at “Virtual Private Network Service (VPN Service) providers” as a category, without specifying where these providers locate their servers, offices or operations.³¹ What the practical effect of the 2022 Directions has demonstrated, however, is that they have hastened the very result they were intended to prevent: instead of compelling the provider to keep subscriber records accessible in India, the Directions have encouraged the provider to move away the infrastructure that would have made such records accessible locally. The provider still serves the Indian market, earns money from Indian subscribers and offers Indian IP addresses, but has escaped the practical scope of CERT-In’s compliance and enforcement mechanisms.

The problem is compounded by the limited transparency about enforcement. The Internet Freedom Foundation reported in April 2023, about a year after the Directions were issued, that in response to its Right to Information applications CERT-In stated only that notices seeking compliance with Direction (v) had been issued to some VPN service providers in February 2023, that their responses were “under examination”, and that no blocking or other proceedings had been initiated; it declined to disclose how many notices had been issued or to which companies.³² It is therefore hard to judge whether CERT-In has pursued enforcement against the foreign providers who left the Indian server market beyond such notices, or whether the absence of any visible enforcement indicates that action against companies with no presence in India has, in effect, been acknowledged to be impractical.

D. Judicial approaches to jurisdiction and data regulation

Whether the IT Act’s provisions extend to conduct and entities based outside India is addressed, at a general level, by Section 75 of the Act, which provides that its provisions apply “also to any offence or contravention committed outside India by any person irrespective of his nationality”, subject to the qualification in sub-section (2) that the act or conduct constituting the offence or contravention must involve “a computer, computer system or computer network located in India”.³³ On its face, Section 75 asserts a broad extraterritorial reach grounded in the effects that conduct produces within India rather than in the physical location of the person responsible for it.

International law scholarship, however, commonly distinguishes between a State’s jurisdiction to prescribe and its jurisdiction to enforce: while the former refers to the power to regulate an activity and prescribe behaviour, the latter refers to the capacity of a State actually to enforce its laws through its executive and judiciary, which is necessarily more circumscribed.³⁴ This distinction is directly relevant to CERT-In’s position vis-à-vis foreign VPN providers: even assuming that CERT-In’s Directions are validly issued and apply, in principle, to entities based abroad, they carry prescriptive force without any real power of enforcement, since foreign entities with no presence in India are not, in practice, amenable to the jurisdiction of Indian courts. In other words, while Sections 1(2) and 75 of the IT Act may extend the Act’s reach to foreign entities, there is no procedure by which such entities can be compelled to appear in Indian courts to answer a CERT-In direction, let alone face penalties for non-compliance. The absence of any mechanism to compel such entities to appear, to respond or to satisfy a penalty leaves the prescriptive claim without a corresponding enforcement pathway. It bears mentioning that no Indian court has yet had to grapple with Section 70B directions applied to foreign entities, which is consistent with this paper’s thesis that such enforcement has not been attempted.

This tension surfaced before the Delhi High Court in SnTHostings v. Union of India, a writ petition filed in September 2022 by a hosting, VPN and VPS service provider directly challenging the validity of the 2022 Directions.³⁵ The petitioner contended that Directions (iv) and (v), which include the data retention requirements examined in this paper, were beyond the powers conferred on CERT-In by Section 70B(6), were vague, and effectively prohibited VPN service providers from operating in India, in violation of the right to carry on business under Article 19(1)(g) of the Constitution.³⁶ Notice was issued on 28 September 2022, CERT-In filed a reply in defence of the Directions on 8 December 2022, and the Court permitted the petitioner to file a rejoinder; on 14 March 2024, however, the petition was withdrawn on the petitioner’s instructions, without any ruling on the merits.³⁷ Although the petition was framed primarily as a challenge to the Directions’ validity rather than to their extraterritorial enforceability, its outcome would have borne directly on the question this paper examines: a finding that the Directions were ultra vires CERT-In’s statutory authority would have further undermined the precarious position of Indian authorities seeking to enforce them against providers who have, in any event, relocated beyond India’s practical reach. Its withdrawal leaves both questions judicially untested.

The absence, to date, of any reported judicial decision specifically addressing the enforceability of a Section 70B(6) direction against a foreign-based service provider with no presence in India is, in itself, significant. It suggests either that no such enforcement action has been attempted, or that such action has not yet produced a judicial record capable of testing the proposition. Either possibility supports this paper’s contention that a genuine enforcement gap exists which existing jurisprudence has not been called upon to resolve.

E. Comparative and jurisdictional analysis

Having established that CERT-In’s authority to direct foreign VPN providers is not legally untenable on paper, but that the practical question of how such a direction can be enforced against entities that do not operate from within India remains open, this section turns to two regimes which have grappled with a similar issue and whose solutions may show how the enforcement vacuum suffered by CERT-In’s Directions could be bridged.

The United States’ Clarifying Lawful Overseas Use of Data Act (CLOUD Act), enacted in March 2018, amended the Stored Communications Act to provide that “[a] provider of electronic communication service or remote computing service shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication … within such provider’s possession, custody, or control, regardless of whether such communication … is located within or outside of the United States.”³⁸ In other words, the CLOUD Act asserts jurisdiction over data held abroad by any provider subject to U.S. jurisdiction, and, through the “possession, custody, or control” standard, over data held by the foreign subsidiaries of U.S. companies.³⁹ This formulation constitutes a jurisdictional hook that a provider could not evade simply by shifting its servers overseas while continuing to operate in the U.S.: a provider incorporated in the U.S., or having sufficient (“minimum”) contacts with the U.S., is subject to compelled disclosure.⁴⁰

An analogous principle is at work in the EU’s e-Evidence Regulation (Regulation (EU) 2023/1543), which has applied since 18 August 2026. The Regulation allows a European Production Order to be addressed to “a service provider offering services in the Union and established in another Member State, or, if not established, represented by a legal representative in another Member State”, to produce electronic evidence “regardless of the location of the data”.⁴¹ A service provider offers services in the Union where it enables persons in a Member State to use its services and has a substantial connection with that State, which exists where it has an establishment there or, in the absence of an establishment, where it has a significant number of users in, or targets its activities towards, one or more Member States. Under the companion Directive (EU) 2023/1544, a provider offering services in the Union without being established there must appoint a legal representative to receive, comply with and enforce production and preservation orders, and Member States must lay down penalties for non-compliance, which under the Regulation may reach 2% of the provider’s total worldwide annual turnover.⁴²

Applied to the Indian context, this comparison highlights an apparent lacuna in India’s legal framework that could explain why CERT-In’s Directions appear to have had limited practical effect: while Section 70B(6) speaks of “service providers” and “any other person”, it does not specify what jurisdictional connection such entities must possess to fall within CERT-In’s authority, leaving it unclear whether an entity that operates exclusively from outside India, but continues to offer its services to Indian users and to derive revenue from them, would be subject to CERT-In’s directions in any enforceable sense.⁴³ The CLOUD Act and the e-Evidence Regulation do not adopt the approach embodied in Section 70B(6): as shown above, they make a provider’s presence in, or (in the U.S.) sufficient contacts with, the U.S. or the EU enough to subject it to a production order, and the EU regime, where a provider targets the EU market without being established there, requires it to appoint a legal representative in the EU as a condition of operating there.⁴⁴ If Section 70B were to adopt a similar principle, it would bridge the jurisdictional gap suffered by CERT-In’s 2022 Directions by grounding jurisdiction in the provider’s commercial nexus with India.

That commercial nexus is precisely what the major VPN providers have been able to retain while escaping regulatory consequence: by relocating their servers overseas while continuing to serve Indian users, they remained outside the practical reach of CERT-In’s authority, a situation that would not arise if India possessed a CLOUD Act-style or e-Evidence-style jurisdictional hook for such entities. Under the e-Evidence Regulation, by contrast, the mere fact that a foreign provider targets the EU market renders it subject to production orders issued by national authorities, and the requirement to appoint a legal representative gives those orders an addressee within the Union; under the CLOUD Act, a provider with sufficient contacts with the United States is likewise subject to U.S. legal process. It can therefore be inferred that bridging the jurisdictional gap suffered by CERT-In’s Directions would require amending Section 70B to apply expressly to any entity offering its services to Indian users, or deriving revenue from such users, regardless of where its servers or other infrastructure are located, and to require such foreign entities to appoint legal representatives in India as a precondition of operating there.

F. Enforcement mechanisms and their limits

Having established the jurisdictional gap that prevents CERT-In from binding foreign VPN providers, this section turns to the enforcement tools actually available to Indian authorities, and shows why each proves structurally inadequate against a provider with no footprint on Indian soil. The analysis moves the paper’s argument from the theoretical (that there is a gap in the legislation) to the practical (that, even if there were no gap in the legislation, Indian authorities would have no realistic way of compelling a provider that has no physical connection with India to comply with CERT-In’s directions).

The first option available to the Indian authorities is prosecution for non-compliance with a CERT-In direction under Section 70B(7) of the IT Act, which allows imprisonment of up to one year, a fine of up to one crore rupees, or both.⁴⁵ This option presupposes that the non-compliant entity, or a representative of it, can be identified, located and brought before an Indian court, a presumption that collapses once the entity withdraws its only physical contact with Indian territory. Section 70B(8) adds a procedural condition, since no court may take cognizance of the offence except on a complaint by an officer authorised by CERT-In.⁴⁶ Such a complaint may name a foreign company, but where the entity maintains no registered office, director or employee within India, there is no one who can practically be summoned, arrested or made to answer it: the difficulty is not merely procedural but, in most cases, insurmountable.

A second option is the blocking of access to the non-compliant service under Section 69A of the IT Act, which enables the Central Government, where it is satisfied that it is necessary or expedient to do so in the interest of the sovereignty and integrity of India, the defence of India, the security of the State, friendly relations with foreign States or public order, or for preventing incitement to the commission of any cognizable offence relating to these, to direct any agency of the Government or any intermediary to block access by the public to any information generated, transmitted, received, stored or hosted in any computer resource.⁴⁷ This remedy is blunt, and it is least effective against the very category of service it would target. MeitY itself, in an advisory of 25 April 2026 addressed to VPN service providers and intermediaries in respect of blocked betting and prediction-market websites, recorded that “certain users are circumventing the legal restrictions imposed on such platforms by misusing VPN services to access these websites”.⁴⁸ The acknowledgment is telling, as it implies that the technology CERT-In tried to regulate through its 2022 Directions is the same technology that defeats this fallback enforcement mechanism, producing a closed loop in which blocking a particular VPN provider accomplishes very little, since users can simply reach it, or any other service, through a different VPN. In July 2026 a senior government official was reported as saying that the providers “have simply refused to comply” with the 2022 Directions, so that “the need for a full-fledged law is being felt”, with the proposals reportedly including mandatory local offices and compliance officers for VPN providers.⁴⁹ Coming from within government, this is not a criticism levelled from the outside but an acknowledgment that the existing remedies are of limited use against offshore VPN providers.

A third option is diplomatic or treaty-based cooperation, primarily in the form of Mutual Legal Assistance Treaties (MLATs), under which India could request cooperation from the State in which the non-compliant provider is headquartered. This option is largely moot given the jurisdictional choices of two of the largest providers that withdrew their Indian servers: NordVPN operates under the jurisdiction of Panama, which, NordVPN states, has no mandatory data retention law, and ExpressVPN’s headquarters and registered place of business are in the British Virgin Islands, a choice it presents as serving its privacy mission. Both are thus largely out of reach of a data-retention request, almost by design.⁵⁰ Even where a treaty relationship exists, MLAT processes are widely considered slow and resource-intensive, routinely taking months or years to yield results, a timeline incompatible with the operational cycle of cyber-incident response that CERT-In’s Directions were meant to facilitate.

Each of these three mechanisms (prosecution, blocking and treaty cooperation) is undermined by the same fundamental flaw: each assumes a point of contact with the regulated entity, whether a defendant for prosecution, a domestic access point for blocking or a treaty partner willing to cooperate, and a foreign VPN provider can defeat them all at once simply by maintaining no Indian presence. This is exactly what differentiates India’s position from that of the United States and the European Union, whose CLOUD Act and e-Evidence Regulation anchor enforcement in the provider’s connection with the regulating market rather than in the location of its data, and, in the EU’s case, oblige a provider without an establishment to create the necessary point of contact by appointing a legal representative.⁵¹ The lack of any such jurisdictional hook in Indian law is, this paper argues, the central reason why CERT-In’s 2022 Directions have proven unenforceable against precisely the class of provider most likely to evade them.

Discussion

The findings of this part, taken as a whole, demonstrate that CERT-In’s 2022 Directions suffer from more than a drafting defect: because they do not account for the territorial ambiguity of the medium in which they operate, they fail to exert authority over the most privacy-conscious VPN providers, defeating the very purpose of the regulation.

The jurisdictional risk presented by the statutory design of Section 70B is not one of theoretical capability, as the analysis of CERT-In’s statutory mandate shows: it is an immediate risk of enforcement deficit, as the industry’s response to the Directions demonstrates. The availability of no-logs services gives providers a strong commercial incentive to relocate their infrastructure beyond the reach of Indian law and, by extension, of any enforcement action, including requests under mutual legal assistance treaties, as the discussion of the industry response and of the enforcement mechanisms shows. This jurisdictional risk of enforcement deficit, stemming from the very design of the 2022 Directions, is the single most important finding of this research.

As the comparative analysis demonstrates, this design choice was not inevitable: the CLOUD Act and the EU’s e-Evidence Regulation show that an alternative paradigm, based on a provider’s commercial connection with the regulating market, exists and has been adopted by other democracies. The resulting enforcement deficit, which CERT-In’s limited transparency about enforcement has done nothing to dispel, is one that the Indian judiciary has not yet had to confront, but one that Indian courts will have to address in due course.

It must be stressed that this finding, while demonstrated through the CERT-In VPN episode as the clearest example, may reflect a broader difficulty in regulating services delivered to Indian users from abroad. The enforcement void described in this paper is one of the most immediate consequences of that design flaw.

This is not to dismiss the cybersecurity objectives of CERT-In’s 2022 Directions: the desire to trace the sources of potential cyber-attacks is a valid one, and regimes such as the CLOUD Act and the e-Evidence Regulation apply analogous principles to cross-border access to electronic evidence. The aim here is rather to highlight the ways in which the objective of cybersecurity was undermined by implementation choices based on an incomplete account of jurisdiction. The analysis in this part informs the recommendations set out below.

Conclusion

This paper set out to determine whether CERT-In’s data retention directions could be practically enforced against foreign VPN entities that have no physical presence in India. The evidence examined confirms the initial hypothesis that such directions cannot be enforced, owing to the absence of the necessary tools in India, despite CERT-In’s authority to issue them.

The research confirmed that CERT-In’s ability to issue data retention directions to foreign entities which have no physical presence in India cannot be translated into practical enforcement. The legislation reviewed above shows that while Section 70B(6) of the Information Technology Act, 2000 appears to authorise CERT-In to direct such entities, it does not define the jurisdictional basis on which such directions may be enforced. Meanwhile, the extraterritorial provisions of the CLOUD Act and the e-Evidence Regulation show that such enforcement is possible, but only where a provider has a sufficient connection, commercial or otherwise, with the requesting jurisdiction. In the case of the 2022 Directions, the providers examined ceased to maintain physical servers within India but continued to provide services to its residents from abroad, which no Indian court could prevent.

In terms of the paper’s research questions, the investigation found that while CERT-In’s authority is expressly stated in Section 70B(6), the provision does not account for the possibility of a foreign company having no physical presence in India. Moreover, the response of the providers examined to CERT-In’s Directions allows general conclusions to be drawn about the ability of Indian law to regulate the activities of foreign technology companies. In particular, the findings concern the jurisdictional limits of Indian law, which is unable in practice to impose restrictions on foreign companies that have no physical presence within the country. Furthermore, the research identified foreign legal instruments which expressly provide for such jurisdiction, as well as alternative mechanisms of cyber diplomacy which India is not currently using.

The limitations of India’s cyber diplomacy identified in this research do not concern the ability of Indian law to impose obligations on foreign technology companies. Rather, they reflect a gap in drafting legislation that exercises jurisdiction over foreign entities. The CERT-In VPN episode is one example of such a gap, which may be addressed, alongside other issues, by the reforms suggested in the following section.

Recommendations

The enforcement gap described in this paper admits of several possible solutions in light of the diagnosis offered above:

1.  Introduction of a jurisdictional nexus test: Section 70B(6) could be amended, or CERT-In’s implementing directions revised, to extend CERT-In’s enforcement jurisdiction to any foreign provider offering services to, or deriving revenue from, Indian users, irrespective of where its servers are located, by adopting a test modelled on the EU e-Evidence Regulation’s “offering services in the Union” test.

2.  Requirement for a local legal representative: India could require any foreign VPN provider without an Indian establishment to appoint a legal representative in India amenable to service of CERT-In’s directions, by analogy with the EU’s requirements for providers without an establishment in a Member State.

3.  Reconsideration of the retention mandate: The five-year retention requirement in clause (v) may itself have caused a number of providers to withdraw their servers from India. A more graduated approach, such as differential retention mandates or retention of data only to the extent needed for incident attribution, might mitigate this unintended consequence for India’s cybersecurity objectives.

4.  Enhanced international cooperation: Given the slow pace of processing under the MLAT framework, India might explore bilateral arrangements for cooperation in investigations with jurisdictions where a large number of VPN providers are incorporated, such as Panama and the British Virgin Islands, possibly modelled on the executive agreements contemplated by the CLOUD Act.

5.  Enhanced transparency in enforcement: CERT-In’s unwillingness to disclose compliance-notice data has left a gap in the research, which could be remedied by regular disclosure of the directions issued and of enforcement outcomes.

Taken together, such measures would bring India’s approach closer to the frameworks examined in this paper, which have grappled with the same enforcement gap.

*****

Footnotes

1. The Information Technology Act, 2000, § 70B(1), (4), (6), No. 21, Acts of Parliament, 2000 (India).

2. Indian Computer Emergency Response Team, Directions Under Sub-Section (6) of Section 70B of the Information Technology Act, 2000 Relating to Information Security Practices, Procedure, Prevention, Response and Reporting of Cyber Incidents for Safe & Trusted Internet, No. 20(3)/2022-CERT-In, pmbl. (Apr. 28, 2022), https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf [hereinafter CERT-In Directions] (CERT-In having been appointed under § 70B(1) by notification dated Oct. 27, 2009).

3. CERT-In Directions, supra note 2, cl. (v)(a)–(g).

4. Gayatri Malhotra, Top Secret: One Year On, CERT-In Refuses to Reveal Information About Compliance Notices Issued Under Its 2022 Directions on Cybersecurity, Internet Freedom Foundation (Apr. 28, 2023), https://internetfreedom.in/top-secret-one-year-on-cert-in-refuses-to-reveal-information-about-compliance-notices-issued-under-its-2022-directions-on-cybersecurity/.

5. Siddharth Chaturvedi & Himanshi Srivastava, The Constitutionality of the New Indian CERT-In VPN Rules, 13 Int’l Data Priv. L. 331 (2023), https://doi.org/10.1093/idpl/ipad015.

6. Cedric Ryngaert, Extraterritorial Enforcement Jurisdiction in Cyberspace: Normative Shifts, 24 German L.J. 537 (2023), https://doi.org/10.1017/glj.2023.24.

7. John Selby, Data Localization Laws: Trade Barriers or Legitimate Responses to Cybersecurity Risks, or Both?, 25 Int’l J.L. & Info. Tech. 213 (2017), https://doi.org/10.1093/ijlit/eax010.

8. Ankit Sourav Sahoo, From Puttaswamy to DPDP: Tracing the Legislative Journey of Data Privacy in India, Int’l J. Sci. & Rsch., Mar. 2026, at 1012, https://doi.org/10.21275/sr26317112521; see Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1; The Digital Personal Data Protection Act, 2023, No. 22, Acts of Parliament, 2023 (India).

9. CERT-In Directions, supra note 2, cl. (v); The Information Technology Act, 2000, § 70B(6), No. 21, Acts of Parliament, 2000 (India).

10. ExpressVPN, Rejecting Data Demands, ExpressVPN Removes VPN Servers in India, ExpressVPN Blog (June 2, 2022), https://www.expressvpn.com/blog/remove-india-vpn-servers/; Chiara Castro, Another Top VPN Company Just Pledged to Pull Its Servers Out of India, TechRadar (June 7, 2022), https://www.techradar.com/news/another-top-vpn-company-just-pulled-its-servers-from-india.

11. See, e.g., Chaturvedi & Srivastava, supra note 5.

12. SnTHostings v. Union of India (Del. HC, filed Sept. 2022, withdrawn Mar. 14, 2024); Internet Freedom Foundation, Delhi HC Permits SnTHostings to Withdraw Petition Challenging the Legality of 2022 Directions (Mar. 18, 2024), https://internetfreedom.in/snthostings-withdraw-petition-legality-of-2022-directions/.

13. The Information Technology Act, 2000, § 70B(1), (4), (6)–(8), No. 21, Acts of Parliament, 2000 (India); The Information Technology (Amendment) Act, 2008, No. 10, Acts of Parliament, 2009 (India) (inserting § 70B); The Jan Vishwas (Amendment of Provisions) Act, 2023, sch., item 32(I), No. 18, Acts of Parliament, 2023 (India) (substituting “one crore” for “one lakh” in § 70B(7)), in force Nov. 30, 2023, vide S.O. 4745(E) (Oct. 31, 2023).

14. Indian Computer Emergency Response Team, FAQs on Cyber Security Directions of 28.04.2022, Q. 44 (May 2022), https://www.cert-in.org.in/PDF/FAQs_on_CyberSecurityDirections_May2022.pdf [hereinafter CERT-In FAQs]; CERT-In Directions, supra note 2, pmbl. & final para. (“This direction will become effective after 60 days from the date on which it is issued.”).

15. Indian Computer Emergency Response Team, Extension of Timelines for Enforcement of Cyber Security Directions of 28th April, 2022 Issued Under Sub-Section (6) of Section 70B of the Information Technology Act, 2000 for MSMEs and Also for Implementation of Mechanism for Validation of Subscribers/Customers Details by Data Centres, VPS Providers, Cloud Service Providers and VPN Service Providers, No. 20(3)/2022-CERT-In (June 27, 2022), https://www.cert-in.org.in/PDF/CERT-In_directions_extension_MSMEs_and_validation_27.06.2022.pdf (deferring cl. (v)(a) and (f)).

16. CERT-In Directions, supra note 2, cls. (i)–(v).

17. Id. cl. (i).

18. Id. cl. (ii) & annex. I; cf. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation), art. 33(1), 2016 O.J. (L 119) 1 (notification “not later than 72 hours” after becoming aware of a personal data breach).

19. CERT-In Directions, supra note 2, cl. (iv).

20. CERT-In Directions, supra note 2, cl. (v).

21. CERT-In FAQs, supra note 14, Q. 34.

22. CyberGhost, India’s Data Collection Rule Is Forcing Us Out – We’re Removing Our Indian Servers, CyberGhost Privacy Hub, https://www.cyberghostvpn.com/privacyhub/india-vpn-servers-remove/ (last visited Sept. 29, 2026).

23. The Information Technology Act, 2000, §§ 1(2), 70B(7), No. 21, Acts of Parliament, 2000 (India).

24. CERT-In FAQs, supra note 14, Qs. 26, 29.

25. ExpressVPN, supra note 10.

26. Castro, supra note 10.

27. Jim Martin, Why VPN Services Have Shut Down Their Indian Servers, Tech Advisor (June 27, 2022), https://www.techadvisor.com/article/795538/vpn-india-servers-shut-down.html.

28. CyberGhost, supra note 22.

29. ExpressVPN, supra note 10 (virtual India servers “physically located in Singapore and the UK”); CyberGhost, supra note 22.

30. CERT-In FAQs, supra note 14, Q. 26.

31. CERT-In Directions, supra note 2, cl. (v).

32. Malhotra, supra note 4.

33. The Information Technology Act, 2000, § 75(1)–(2), No. 21, Acts of Parliament, 2000 (India).

34. James Crawford, Brownlie’s Principles of Public International Law 440–56 (9th ed. 2019); Cedric Ryngaert, Jurisdiction in International Law (2d ed. 2015).

35. Krishnesh Bapat, Anandita Mishra & Tanmay Singh, Delhi HC Issues Notice in SnTHosting’s Challenge to Legality of CERT-In’s Directions, Internet Freedom Foundation (Sept. 28, 2022), https://www.internetfreedom.in/delhi-hc-issues-notice-in-snthostings-challenge-to-legality-of-cert-ins-directions/; see SnTHostings, supra note 12.

36. Bapat, Mishra & Singh, supra note 35.

37. Internet Freedom Foundation, Delhi HC Permits SnTHostings to Respond to the CERT-In’s Defence of the 2022 Directions (Dec. 10, 2022), https://internetfreedom.in/delhi-hc-permits-snthostings-to-file-a-rejoinder-to-the-cert-ins-defense-of-the-2022-directions/; Internet Freedom Foundation, Delhi HC Permits SnTHostings to Withdraw Petition, supra note 12.

38. Clarifying Lawful Overseas Use of Data Act, Pub. L. No. 115-141, div. V, § 103(a)(1), 132 Stat. 348, 1214 (2018) (codified at 18 U.S.C. § 2713).

39. Barry Appleton, Balsillie Sch. of Int’l Affs., Whose Law Governs Canadian Data? The CLOUD Act, Executive Agreements and Digital Sovereignty § 3.4, at 10 (2026), https://balsilliepapers.ca/wp-content/uploads/2026/03/Special-Report-Canadian-Data.pdf.

40. Id.

41. Regulation (EU) 2023/1543 of the European Parliament and of the Council of 12 July 2023 on European Production Orders and European Preservation Orders for Electronic Evidence in Criminal Proceedings and for the Execution of Custodial Sentences Following Criminal Proceedings, arts. 1(1), 34, 2023 O.J. (L 191) 118.

42. Directive (EU) 2023/1544 of the European Parliament and of the Council of 12 July 2023 Laying Down Harmonised Rules on the Designation of Designated Establishments and the Appointment of Legal Representatives for the Purpose of Gathering Electronic Evidence in Criminal Proceedings, arts. 3(1), 5, 2023 O.J. (L 191) 181; Regulation (EU) 2023/1543, supra note 41, arts. 3(4), 15(1).

43. The Information Technology Act, 2000, § 70B(6), No. 21, Acts of Parliament, 2000 (India).

44. Regulation (EU) 2023/1543, supra note 41, arts. 1(1), 3(4); Directive (EU) 2023/1544, supra note 42, art. 3(1); Appleton, supra note 39, § 3.4, at 10.

45. The Information Technology Act, 2000, § 70B(7), No. 21, Acts of Parliament, 2000 (India) (as amended by the Jan Vishwas (Amendment of Provisions) Act, 2023); see also Section 70B in The Information Technology Act, 2000, Indian Kanoon, https://indiankanoon.org/doc/80680324/ (text before the 2023 amendment).

46. The Information Technology Act, 2000, § 70B(8), No. 21, Acts of Parliament, 2000 (India).

47. The Information Technology Act, 2000, § 69A(1), No. 21, Acts of Parliament, 2000 (India).

48. Ministry of Electronics and Information Technology, Advisory to VPN Service Providers and Intermediaries (Apr. 25, 2026), as quoted in Prabhanu Kumar Das, MeitY Warns VPN Providers Against Enabling Access to Blocked Betting Platforms, MediaNama (Apr. 29, 2026), https://www.medianama.com/2026/04/223-meity-warns-vpn-providers-over-betting-sites/.

49. Chiara Castro, India Weighs Stricter VPN Regulations to Stop Users from Bypassing Internet Blocks, TechRadar (July 3, 2026), https://www.techradar.com/vpn/vpn-privacy-security/india-weighs-stricter-vpn-regulations-to-stop-users-from-bypassing-internet-blocks (reporting The Indian Express).

50. NordVPN, Where Is NordVPN Based, NordVPN Customer Support, https://support.nordvpn.com/hc/en-us/articles/19441152966161-Where-is-NordVPN-based (Panama jurisdiction; “no mandatory data retention law in Panama”); ExpressVPN, Privacy Policy, https://www.expressvpn.com/privacy-policy (headquarters and registered place of business in the British Virgin Islands); VPNpro, https://vpnpro.com/blog/hidden-vpn-owners-unveiled-97-vpns-23-companies/ (VPN ownership and jurisdictions).

51. 18 U.S.C. § 2713; Regulation (EU) 2023/1543, supra note 41, arts. 1(1), 3(4); Directive (EU) 2023/1544, supra note 42, art. 3(1).