Is using a VPN legal in India?

Question

I want to know if using a VPN service for privacy or accessing content is legal under Indian law. I have been reading conflicting things online and I would like to understand what Indian law actually says about this, which Act and Section applies, what the realistic timelines and costs are, and what I should be doing right now to protect my position. If the matter can be resolved without litigation I would prefer that route, but I want to know what my rights are before I agree to anything or sign any document.

MyVakeel Legal Desk · Accepted Answer

Is using a VPN legal in India? is governed in India primarily by Information Technology Act, 2000 – Section 69A, CERT-In Directions, 2022 and Information Technology Act, 2000 – Section 66. The short answer is set out below, followed by the practical steps most people in this situation need to take. Read it alongside the specific provisions named, because the exact relief available to you turns on the facts you can prove on paper.

Using a VPN itself is legal in India — there is no law banning VPN usage by individuals for privacy, security or accessing legitimate content, provided the underlying activity conducted through it is lawful.

Under the CERT-In Directions of April 2022, VPN service providers offering services to the general public in India (not enterprise/corporate VPNs) are required to maintain customer records (name, address, purpose of use, validity period, IP addresses assigned) for a minimum of 5 years and provide them to authorities when required.

Several major VPN providers stopped offering physical India-based servers after this rule because they refuse to log user data as required, but this does not make VPN use itself illegal for Indian residents — it just changes where the VPN's servers are located.

Using a VPN to access content blocked under Section 69A of the IT Act does not make the underlying block lawful to circumvent — while VPN use is not illegal, using it specifically to access unlawful/blocked content (like a proscribed website or to distribute illegal material) exposes you to liability for the underlying offence, not for VPN use per se.

Using a VPN to commit an offence (fraud, hacking, distributing illegal content) does not provide any legal immunity — investigators can still trace VPN providers through the mandated logs or via international cooperation.

What to do next: 1) Use VPNs from providers that comply with applicable data retention norms if operating in India; 2) Avoid using VPNs to access content specifically blocked under a government order; 3) Understand that VPN use does not shield you from liability for any underlying unlawful activity; 4) Consult a lawyer if you are served notice regarding VPN-related activity.

If the other side has already issued a notice, filed a case or set a deadline, treat the matter as time-sensitive — most remedies under Information Technology Act, 2000 – Section 69A carry limitation periods, and a delay you cannot explain weakens an otherwise strong case. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in this practice area.