It’s generally ideal to use a no-logs VPN based in a privacy-friendly country (like Switzerland or the British Virgin Islands) — most of the VPNs on my list have headquarters in such locations.
But you can also use a VPN in a 5/9/14 Eyes country if its no-logs policy has been verified. That way, even if government authorities ask the provider for user data, the VPN can’t hand anything over because it doesn’t keep any logs. For example, Private Internet Access is based in the US, but its no-logs policy passed an independent audit and has also been proven true in court documents on several occasions. Also, it issues regular transparency reports that detail what user data requests it received, and all of its apps are open-source, meaning anyone can inspect the code for security vulnerabilities.