The Indian government has issued a directive for VPN services operating in the nation to record user data. This information was made public by the Indian Computer Emergency Response Team (CERT-In), a sub-division of India’s Ministry of Information and Technology.
The mandate requires data centers, VPN providers, virtual private server (VPS) providers, and cloud storage services to keep user data for a minimum of five years. The CERT-In division stated that the directive was a result of an attempt to patch gaps that prevented proper security analysis.
According to the disseminated order, VPN services will have to note their users’ physical location, IP addresses, and internet activities. This implies that all NordVPN locations in India will be required to store users’ data as directed by the government. To protect users’ sensitive information, some VPN companies, such as NordVPN, operate in a different location that values privacy.
The affected companies were informed of this decision in May, and the law came into effect on July 27. According to the mandate, failure to comply will lead to a one-year sentence in prison.
Details of the directive for VPN companies
Every VPN firm operating in the country must store and keep user records even if the user has deleted their account. Because of this directive, some VPN companies have started removing their servers from India. CERT-In further extends this mandate to digital currency exchanges and data centers.
The firms affected by this order are supposed to keep data to keep in line with Know-Your-Customer (KYC) guidelines for at least five years. It was stated that this measure improves digital security in the financial sector for Indian citizens, given the rise of digital assets.
VPN companies are required to divulge cybersecurity incidents to the CERT-In. These incidents include all forms of malware attacks, website breaches, identity theft, data leaks, attacks on Internet of Things (IoT) devices, bogus smartphone apps, and so on.
How users can improve online privacy measures
Typically, organizations are in a different class of their own when compared to individual internet users. For one, they have a larger pool of resources and can leverage them to snoop on the privacy of citizens.
These organizations include internet service providers (ISPs) and other entities that mine data all over the internet. Even though India has rules that make data spying illegal, some malicious entities still engage in the activity.
Although several individuals are calm about the fact that India declares spying on user data illegal, it wouldn’t matter if the data mining company snoops on your internet activity, creates a profile for you, and then sells the information to other malicious entities.
You have to take some measures to enhance your online privacy as an Indian citizen.
Here are some top-notch measures that you can follow to protect your data from various entities:
Understanding the law
You need to be familiar with your country’s laws before taking measures to protect your online privacy. More importantly, you need to understand every bit of the laws concerning data privacy. If you’re unsure about a specific part, you’d best hire the services of a lawyer.
Understanding the data privacy law helps you know if the measures you take are legal. This way, if anything arises, you’d be better poised to defend yourself.
Utilize a VPN
A Virtual Private Network is one of the best ways to keep your data from malicious entities. Whether you’re being attacked by a remote hacker or someone physically close to you, they wouldn’t be able to steal your information effectively.
If the cybercriminal attempts to breach your Wi-Fi network, all they’d see is a bunch of numbers and symbols strung together.
That’s because VPNs protect information with high-level encryption techniques. As a plus, VPN locations can offer you access to geo-restricted content. For instance, when you connect to a NordVPN location like the US, you’d be able to get access to content that is only available in the US.
Understand your provider
You need to be conversant with your providers’ data collection policies. Your providers include everyone who offers you internet access, including virtual private networks, virtual private servers, internet service providers, and cloud storage services.
Various providers across the globe follow different rules depending on the laws of the region they’re situated in. If you find that your service provider collects too much user data, you’ll have to settle for another one.
Communicate with your team
If you’re in charge of a firm, you need to communicate with your IT team, so they understand what’s at stake. A company’s data getting leaked could spell disaster for the firm. Information leaks have different consequences depending on the industry you’re in.
Clients might be unwilling to work with a company that doesn’t effectively protect its data. Also, if company data gets leaked, strategies could get exposed. This could negatively impact the firm’s potential to make revenue.
You need to discuss leveraging tools that protect company data with your team. You also have to mandate them to notify you once they spot unusual activity. This way, you’d be better informed on the next steps to take.
Imbibe good cybersecurity practices
You need to imbibe good cybersecurity practices to keep your activities private. You can start by modifying your passwords once every 6 months. This way, hackers would find it difficult to penetrate your online accounts.
Another great cybersecurity practice is to activate two-factor authentication on the needed accounts. Two-factor authentication gives you an added layer of security, translating into higher difficulty for hackers.
For instance, if a hacker gets their hands on your username and password, they’d be locked out of your account since they wouldn’t have access to the two-factor authentication code.
The Indian Computer Emergency Response Team (CERT-In) agency has ordered VPN services to start collecting user data. The key reason for this mandate is so that proper security analysis can be performed during cybersecurity incidents.
As such, every cloud storage service, VPN provider, VPS provider, and internet service provider is required to divulge information related to digital security breaches. This includes malware, data leaks, website intrusions, and identity theft.
To boost your privacy online, you must take certain measures, including communicating with your team, understanding the law, and understanding your providers’ policies. You also need to implement good cybersecurity practices like using two-factor authentication, changing passwords frequently, and utilizing a virtual private network.