After ExpressVPN, Surfshark also leaves India due to data retention rules
India recently introduced new data retention rules for VPN services and as a result, several services are leaving the country. ExpressVPN recently announced this and Surfshark is now following suit. The rules require VPN services to hand over user data.
Surfshark reports on its own blog that it is closing its servers in India in response to the new Indian data retention rules. The company says it will shut down its physical servers in the country before the new law takes effect. Until then, users can connect to Indian servers of the VPN service as usual. The new law was announced at the end of April and gives VPN providers two months to comply with the new obligations. That will mean that Surfshark will close its Indian servers at the end of this month: the rules will take effect on June 27.
The VPN service emphasizes that the rules create an obligation to create customer logs and keep them for 180 days. Surfshark particularly objects to the obligation to collect and store ‘excessive’ customer data for a period of five years. The latter concerns usernames, e-mail addresses, telephone numbers, timestamps and user patterns. The IP address with which the customer registered and the IP address assigned by the VPN service must also be retained for a period of five years.
The vpn services are required to hand over this kind of information at the request of the Indian Computer Emergency Response Team. The idea behind the law is a more robust approach to cybercrime. For that purpose, it has been included in the law that VPN services must also report cyber incidents, such as spoofing, phishing, data leaks, breaches and cases in which unauthorized persons gained access to social media accounts.
ExpressVPN already announced a few days ago that it is going to take down its Indian servers. The company emphasized that customers can still connect to VPN servers that provide access to Indian IP addresses even after the servers are removed. This will be done through ‘virtual’ Indian servers physically located in Singapore and the United Kingdom. Also Surfshark says that virtual Indian servers will become available, although the company does not yet know where these servers will be located.