Is VPN Legal in India? CERT-In Records, 69A Blocks and Kashmir Orders

Yes: using a VPN is legal across India. No central law treats the app itself as an offence, the CERT-In directions of 28 April 2022 bind providers rather than the person who installs one, and Section 69A blocks target platforms and ISPs. The exception is a set of temporary district orders in Jammu and Kashmir. This is a reading of the texts, not legal advice.

Where Indian law draws the line for VPN users

Indian law judges conduct, not the tool. Fraud carried through an encrypted tunnel is still fraud, and the IT Act 2000 and the penal statutes apply as they would without one.

CERT-In's April 2022 directions for VPN companies

CERT-In, the cyber security agency under MeitY, issued its directions on 28 April 2022 under Section 70B(6) of the IT Act, effective 60 days later. The official text lists the duties.

A FAQ of 18 May 2022 carved enterprise and corporate VPNs out of the register rule, and a notice of 28 June 2022 gave providers until 25 September 2022 to build subscriber validation. Ignore a direction and Section 70B(7) applies: up to a year in prison, a fine up to one lakh rupees, or both, prosecuted only on a complaint by an officer authorised by CERT-In. That penalty attaches to whoever received a direction and ignored it; installing a VPN app is not such a case.

Why big providers pulled their Indian servers

A validated identity register cuts against what a consumer VPN sells. ExpressVPN announced in early June 2022 that it would remove its India servers, calling the rules incompatible with the purpose of a VPN; Surfshark followed; NordVPN announced its withdrawal on 14 June 2022. As the providers themselves describe it, NordVPN opened a virtual India location on 2 January 2024 and Surfshark offers virtual servers in India: an Indian IP served from hardware abroad (the glossary entry on virtual locations covers the mechanics). With a physical server in India the provider keeps your identity file under the register rule; with a virtual exit the server itself sits in another country.

How Section 69A blocks apps and websites

Section 69A(1) lets the central government or an authorised officer order a block of public access to online content on grounds of sovereignty, defence, security of the State, friendly relations with foreign States, public order or preventing incitement to a cognizable offence. Reasons are recorded in writing, the 2009 Blocking Rules set the procedure, and the order binds intermediaries: ISPs, platforms, app stores, not the person who opened the app. An intermediary that defies it faces up to seven years and a fine under Section 69A(3). This is the switch used on 29 June 2020 to block TikTok, Shareit, UC Browser, CamScanner and dozens of other apps.

Kashmir district orders on VPN use

The real exposure for a user sits here. Relying on Section 163 of the Bharatiya Nagarik Suraksha Sanhita 2023, district magistrates have banned unauthorised VPN use for set periods: Doda for two months from 2 May 2025 after the 22 April Pahalgam attack, orders in Srinagar, Shopian, Kupwara, Kulgam, Pulwama and Rajouri in late December 2025, and Doda again on 5 September 2026. The September order covers individuals, institutions, cyber cafes, businesses and ISPs in the district, with an exception for VPNs authorised in writing by the administration. Enforcement has been tangible: at least ten cases across the Union Territory in December 2025, security proceedings against 49 users in Shopian, and 140 to 150 people identified after the December and January orders. Lawyers argue Section 163 is the wrong instrument, but no court has ruled on these orders yet.

Practical points for residents, remote workers and visitors

A corporate VPN sits outside the register rule, so remote workers connecting to their employer's systems are unaffected by clause (v). Before travelling to Jammu and Kashmir, check the current district notices: an order can start without warning, and phone checks have been reported in the ordered districts. A VPN does not make an unlawful act lawful. Picking a service is a separate topic, covered on the India VPN page.

FAQ

Is gaming through a VPN okay in India?

Yes, legally. A game's own terms may forbid region switching, and the worst outcome there is an account ban, not a court case.

Can police trace a VPN user?

Your ISP sees that you use a VPN. A provider running Indian hardware also holds your validated identity under the register.

Is VPN banned in Kashmir right now?

Only where a live order applies, and each lasts a fixed period.

Is using a VPN for Netflix illegal in India?

No statute makes it a crime. It can breach Netflix's terms of service.

What the Indian rules come down to

The record-keeping burden from the April 2022 CERT-In directions falls on providers with Indian infrastructure, blocking orders under Section 69A are addressed to platforms and ISPs rather than to users, and the one scenario where the tool itself draws official attention is a time-limited district order in Jammu and Kashmir.