Directions 8-10 impose detailed customer KYC + subscriber-records retention obligations on Data Centre + Cloud Service Provider + Virtual Private Server (VPS) + Virtual Private Network (VPN) service providers - a controversial set of provisions affecting India-facing VPN market. Direction 8: Data Centres + Virtual Private Server (VPS) providers + Cloud Service Providers + Virtual Private Network (VPN) Service providers shall be required to register accurate information of subscribers/customers hiring the services for a period of 5 years or longer duration as mandated by the law after any cancellation or withdrawal of the registration. Direction 9: Categories of subscriber information to be maintained: (a) Validated names of subscribers/customers hiring the services; (b) Period of hire including dates; (c) IPs allotted to/being used by the members; (d) Email address and IP address and time stamp used at the time of registration/onboarding; (e) Purpose for hiring services; (f) Validated address and contact numbers; (g) Ownership pattern of the subscribers/customers hiring services. Direction 10: VPN Service providers in addition shall maintain accurate information of subscribers/customers using their services for a period of 5 years or longer duration as mandated by the law after any cancellation or withdrawal of the registration with the elements provided in Direction 9. Effective date for these specific Directions: 25 September 2022 (extension granted from original 28 June 2022). Practical consequences: led to several no-logs VPN providers (NordVPN + ExpressVPN + ProtonVPN + Surfshark) withdrawing physical servers from India and switching to virtual server presence for India customers + or exiting Indian market. Some VPN providers complied (Hexnode + several Indian providers). Validated information per Direction 9(a) + 9(f) requires KYC standards similar to RBI Master Direction on KYC including identity proof (Aadhaar + PAN + Voter ID + Driving License + Passport) + address proof + contact verification + ownership documentation for organisational customers. Operational implementation: customer onboarding KYC workflow + Aadhaar eKYC where applicable + identity verification + ownership documentation for org subscribers + secure storage + 5-year retention post-cancellation + provision to CERT-In or law enforcement on order + DPDP Act 2023 alignment + customer consent + purpose limitation. Coordinates with IT Act 2000 Sec 79 (intermediary safe harbour requires compliance with statutory directions) + DPDP Act 2023 + RBI Master Direction on KYC + PMLA Prevention of Money Laundering Act + Telecommunications Act 2023 + I4C + sectoral KYC obligations. CERT-In Dir 8-10 Service Provider Obligations applies.
This control maps to 26 controls across 15 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 26 it maps to, and the evidence behind each claim, over MCP and REST.