Yes, the Indian government now requires VPNs to collect user data and store it for up to five years. That’s due to the No. 20(3)/2022-CERT-In data collection directive from India’s Computer Emergency Response Team (CERT-In). This legislation enforces extensive data collection, which means companies with physical infrastructure in the country have to log and keep your details for up to 5 years.  We believe the No. 20(3)/2022-CERT-In ruling is a major threat to online freedom in India. Even though we’re moving our Indian servers out of the country, PIA continues to protect your privacy there. Our worldwide server network also contains new virtual locations equipped with Indian IP addresses.