India delays strict new VPN rules by 3 months – TechCrunch

India will give VPN providers/cloud service operators an extra three months to comply new rules that require them maintain names and addresses of customers and their IP addresses. This will provide some relief for firms as they scramble to adhere to the new guidelines, while others consider the possibility of leaving the South Asian markets.

The Indian Computer Emergency Response Team, the body appointed by the government to protect India’s information infrastructure, saidMonday evening, the new rules will be extended to September 25th. The rules, announced in April, were to take effect on Monday.

CERT said it was extending the deadline because “additional time” had been sought by the industry players.

Its announcement came after strong criticism from VPN providers such as Nord and ExpressVPN who had announced their intention of removing local servers from the country.

Nearly twenty-six cybersecurity experts and technologists have been recruited from India and other parts of the world. sent a joint letter to CERT and Ministry of Electronics and IT on Monday, calling for the “dangerous CERT-In cybersecurity directions” to not be implemented.

“The Directions, as they stand, will have the unintended consequence of weakening cyber security, and its crucial component, online privacy. We are cognisant of the need for a framework to govern cyber incident reporting, but the reporting timelines and excessive data retention mandates prescribed in the Directions, will have negative implications in practice and impede effectiveness, while endangering online privacy and security,” they wrote.

CERT’s new directions require “virtual private server (VPS) providers, cloud service providers, VPN service providers, virtual asset service providers, virtual asset exchange providers, custodian wallet providers and government organisations” to store customers’ names, email addresses, IP addresses, know-your-customer records and financial transactions for a period of five years.

India’s lawmakers have made it clear they are not going to relax the new rules.

Rajeev Chandrasekhar (the junior IT minister in India) said in a press conference last month that VPN providers who wish to conceal who uses their services “will have to pull out” of the country. He also stated that the government is responsible for this. saidThese rules will not be subject to public consultation.

The new rules also require firms to report security lapses, such as data breaches, within six hours of becoming aware. Chandrasekhar was forced to resign after opposition from advocacy groups. said last month that India was being “very generous” in giving firms six hours of time to report security incidents, pointing to nations such as Indonesia and Singapore that he saidThese had stricter requirements.