Directions 8-10 impose detailed customer KYC + subscriber-records retention obligations on Data Centre + Cloud Service Provider + Virtual Private Server (VPS) + Virtual Private Network (VPN) service providers - a controversial set of provisions affecting India-facing VPN market. Direction 8: Data Centres + Virtual Private Server (VPS) providers + Cloud Service Providers + Virtual Private Network (VPN) Service providers shall be required to register accurate information of subscribers/customers hiring the services for a period of 5 years or longer duration as mandated by the law after any cancellation or withdrawal of the registration. Direction 9: Categories of subscriber information to be maintained: (a) Validated names of subscribers/customers hiring the services; (b) Period of hire including dates; (c) IPs allotted to/being used by the members; (d) Email address and IP address and time stamp used at the time of registration/onboarding; (e) Purpose for hiring services; (f) Validated address and contact numbers; (g) Ownership pattern of the subscribers/customers hiring services. Direction 10: VPN Service providers in addition shall maintain accurate information of subscribers/customers using their services for a period of 5 years or longer duration as mandated by the law after any cancellation or withdrawal of the registration with the elements provided in Direction 9. Effective date for these specific Directions: 25 September 2022 (extension granted from original 28 June 2022). Practical consequences: led to several no-logs VPN providers (NordVPN + ExpressVPN + ProtonVPN + Surfshark) withdrawing physical servers from India and switching to virtual server presence for India customers + or exiting Indian market. Some VPN providers complied (Hexnode + several Indian providers). Validated information per Direction 9(a) + 9(f) requires KYC standards similar to RBI Master Direction on KYC including identity proof (Aadhaar + PAN + Voter ID + Driving License + Passport) + address proof + contact verification + ownership documentation for organisational customers. Operational implementation: customer onboarding KYC workflow + Aadhaar eKYC where applicable + identity verification + ownership documentation for org subscribers + secure storage + 5-year retention post-cancellation + provision to CERT-In or law enforcement on order + DPDP Act 2023 alignment + customer consent + purpose limitation. Coordinates with IT Act 2000 Sec 79 (intermediary safe harbour requires compliance with statutory directions) + DPDP Act 2023 + RBI Master Direction on KYC + PMLA Prevention of Money Laundering Act + Telecommunications Act 2023 + I4C + sectoral KYC obligations. CERT-In Dir 8-10 Service Provider Obligations applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.