India is planning to introduce a legal framework that would control virtual private networks (VPNs) operating in the country.

The new measures would require VPN providers to set up a local office and appoint compliance officers to address issues raised by the government.

Prison terms for local officials of VPN service providers failing to comply with the directives are also on the cards.

VPNs encrypt data and provide anonymity online, aiding users to dodge governmental scrutiny and monitoring. They are also used by scamsters and cyber criminals to evade authorities.

The development assumes significance after India’s recent actions against Telegram and WhatsApp over privacy and compliance.

In 2022, the Indian Computer Emergency Response Team (Cert-In) asked VPN service providers to store customer data, including their names, email IDs, contact numbers, and IP addresses.

That attempt failed, however, with major VPN providers shifting their physical servers from India and continuing services with virtual services providing Indian internet protocol addresses.

The VPN providers argued that retention of customer information undermined the privacy protections the services are designed to offer.

That response has prompted the new government initiative, the Indian Express reported.

“There has been rampant abuse of VPN services. People use them to conceal their identity, bypass law enforcement, and access websites that have been blocked in India,” NDTV quoted a senior official as saying.

For instance, when the government blocked Telegram temporarily last month for enabling the leaks of question papers of a key medical entrance test, many in the country continued to access the messaging app using VPNs.

New Delhi has aggressively deployed its content blocking ecosystem, with over 24,000 orders issued last year, double the number in 2024. VPNs stymie that effort, authorities argue.

The objective of the new regulations is to enable agencies to trace those involved in cybercrime and other unlawful activities, officials say.

India registered a 13% rise in data breaches in 2025, with an average cost of $2.31 million, up from $2 million in 2024, according to IBM’s Cost of Data Breach Report.

An estimated half of India’s 800 million internet users rely on VPNs, potentially making it the largest user base globally due to the huge size of its internet population.