India says cloud providers and VPN operators that don't comply with its cybersecurity rules, effective as of June 27, “will have to pull out” of the country
Manish Singh / TechCrunch : Source: Cert-In , Cert-In , and Press Information Bureau .
Context & Ripple Effects
The June enforcement deadline follows India’s April six-hour incident-reporting and VPN identity requirements and a 2021 tightening of obligations for major internet and streaming services. The policy arc makes compliance with government-set cybersecurity and data-retention conditions a requirement for operating digital services in India.
First-order effects
- Cloud providers and VPN operators must implement the Cert-In requirements by June 27 or cease operating in India, putting their local service availability and compliance programs at stake.
- India gains a stated enforcement lever over providers that decline the cybersecurity rules: loss of access to the domestic market.
Second-order effects
- VPN providers face a concrete operating choice between retaining identifying user data and withdrawing infrastructure; ExpressVPN’s subsequent server withdrawal shows how that choice can reduce locally operated service options.
- Providers that remain must absorb the operational burden of rapid incident reporting and recordkeeping, while customers must assess whether their chosen services continue to operate locally.
Third-order effects
- If applied consistently across digital categories, India’s approach shifts internet-market access toward jurisdiction-specific compliance, extending the regulatory pattern set by its earlier rules for large tech and streaming services.
The trend: India is making cybersecurity compliance and data obligations a more explicit condition of access to its digital market.