India’s VPN Data Retention Rules 2026: What They Mean for You

What is being reported

Indian authorities have reportedly introduced new VPN rules scheduled to take effect in September 2026. As reported, the rules would require VPN providers to retain user data and IP addresses for at least five years — including after a customer stops using the service. The stated aim is improved cybersecurity. Because the rules are recent and their implementation details are still being worked through, everything in this article describes them as reported rather than as settled practice.

VPN companies have pushed back, arguing that the requirement is vulnerable to abuse and puts user data at risk. Some providers have reportedly left India, and others are said to be considering it. That reaction is itself informative: it tells you which providers treat long-term retention of connection data as acceptable and which do not.

What would actually be kept

Two categories matter most in the reported rules: account-level user data, and the IP addresses associated with a connection. Reports put the minimum retention period at five years, and describe the obligation as surviving the end of the customer relationship — so cancelling a subscription would not, under the rules as reported, delete what had already been collected.

That last point is the part providers have objected to most. A retention clock that starts at signup and runs years past cancellation means records about someone who used a service briefly could outlive their use of it by a wide margin.

“We log for legal compliance” is a different product from “no-logs”

Many providers already keep some records for billing, fraud prevention, or tax law, and a reputable one publishes exactly what it keeps and why. That can be honest and still be useful. But it is a different product from a strictly no-logs VPN, where the operator designs its systems so that connection data is not retained in the first place.

The distinction is architectural rather than a matter of marketing wording. A provider required to retain IP addresses and timestamps for five years has to build systems that store, index, and protect that data, and it can be compelled to produce it. A no-logs provider avoids the problem by not holding the data at all. Both may be telling the truth; only one of them can truthfully say there is nothing to hand over.

Why an IP address plus a timestamp is more identifying than it sounds

An IP address on its own is not a name, and a single timestamp is not a confession. Together they are a join key. Every other service that also records your address and the time you used it — a social network, a shop, a news site, an email provider, a game server — holds a row that can be matched against it.

The matching does not require the VPN provider to know who you are. It requires only that some other party has a record of which account was using that address at that minute. Long retention windows extend the number of years over which such a match stays possible, and they make the record worth keeping in the first place.

What leaving the jurisdiction does and does not fix

Some providers have reportedly left India or are considering it, and others have withdrawn local servers. Leaving removes local infrastructure and, in principle, the local obligation to retain data collected from there. It does not automatically erase a trail that already exists.

Your account record, your payment history, and anything collected while the provider operated in the jurisdiction may still sit in systems connected to it. A provider with a local entity or local payment processing can still face local orders for whatever it holds. Where a provider is incorporated and where it stores records matters as much as where its servers sit on a map.

If you are in India, or travelling there

For a reader who never comes near an Indian jurisdiction, the direct practical effect of these rules is small. The rules are about what providers operating in India must keep; they do not change how a tunnel works, and they do not make a provider located elsewhere suddenly retain your traffic.

If you are in India, or plan to travel there, the useful questions are concrete: which company holds your account, where that entity is registered, what its published policy says about retention and account closure, and how it responds to requests for data it claims not to hold. Check which servers are actually reachable before you travel rather than assuming the app will behave as it does at home.

What you can practically do

Choose providers whose no-logs claim is published and independently audited if that property matters to you, and prefer providers whose legal entity and data storage sit outside the jurisdiction you are concerned about. Where you can, avoid tying the account to payment details that connect it to the rest of your life. Then treat the privacy policy as a document to re-read when rules change, not a one-time purchase decision.

None of this makes anyone invisible, and it does not need to. It reduces how much durable, correlatable data about you exists in the first place — which is the part you can actually control.

Bottom line

India’s reported rules would put a five-year retention floor under user data and IP addresses, including after a customer leaves. Whether they take effect exactly as reported, they illustrate a wider trend: retention obligations turn ordinary connection records into long-lived identifiers that can be matched against records held elsewhere. The sensible response for most readers is not alarm but a check on where your provider sits, what it says it keeps, and how long it says it keeps it.