In India, the use and misuse of VPNs are governed by several laws:

• Information Technology Act, 2000: Addresses cybercrimes and electronic commerce, making unauthorized access and data theft punishable offenses.
• CERT-In Guidelines (2022): Mandate VPN providers to store user data for at least five years to enhance cybersecurity and assist in investigations.
  timesofindia.indiatimes.com