On April 28, the Indian Computer Emergency Response Team (CERT-In) announced that - among other directives, like the obligation to report a cyber attack within six hours - virtual private network (VPN) providers will soon be required to retain users' logs for at least five years. Companies will be also forced to hand over this data to authorities upon request.
These include users’ real names, IP addresses assigned to them, usage patterns and other identifying data like the purpose of using such software.
What's more, it's not just VPNs that are the subject of the new data retention law . Virtual private servers (VPS), cloud service providers, data centers and crypto exchanges all have to follow the new directive.
Initially planned to come into force on June 28, the new legislation is about to be enforced on September 25.