India requires cyber incidents reported within 6 hours, VPN providers to register users' real names, wallet providers to keep KYC records for five years, more
India's nodal cybersecurity agency, Computer Emergency Response Team (CERT-In), has directed all service providers, intermediaries …
Context & Ripple Effects
CERT-In's directive extends a tightening arc: a year earlier, India had already imposed tougher complaint-resolution and content rules on Facebook, Twitter, WhatsApp, and Netflix, and before that it had prosecuted hundreds of VPN users in Kashmir over 'unlawful activities', establishing both the legal appetite and the target population for identity-linked enforcement.
What changes now is scope: rather than policing individual users case-by-case, the nodal agency shifts the compliance burden onto the infrastructure itself — every service provider, intermediary, VPN operator, and wallet provider becomes a mandatory record-keeper and incident reporter.
First-order effects
- Service providers and intermediaries must stand up six-hour incident-reporting pipelines immediately, while VPN providers must register users' real names — a requirement that directly contradicts the no-logging architecture most commercial VPNs sell.
- Wallet providers must retain KYC records for five years, converting them into long-term custodians of identity data for every transaction they touch.
Second-order effects
- Privacy-positioned VPN operators face a binary: log Indian users' identities and abandon their core product promise, or exit the market — a fork ExpressVPN ultimately took when it pulled its servers out of India, citing the impossibility of complying with the recording mandate.
- Cloud and hosting providers serving Indian customers inherit the same reporting obligations, making local compliance capability a procurement criterion for any multinational operating in the country.
Third-order effects
- If non-compliance effectively means market exclusion, India is structuring its internet around state-verifiable identity at every layer — a template that later extended to devices themselves when the telecom ministry moved to preload the Sanchar Saathi cybersecurity app on new smartphones.
- Other governments watching the enforcement path gain a working playbook for converting cybersecurity agencies into de facto licensing authorities over VPNs, wallets, and intermediaries.
The trend: India is normalizing identity-anchored cybersecurity mandates across successive layers of the stack — platforms, networks, wallets, and now devices — with market access as the enforcement lever.