Data Retention Laws and VPN Jurisdiction: Does Location Matter?

Three legal ideas people mix up

• Data retention laws. Rules requiring communications providers to keep certain records for a set period. Whether a VPN company is covered depends on the country's definition.
• Legal process for data a company already has. Courts, police and agencies can use warrants, subpoenas or production orders to demand whatever a company holds. If the provider holds nothing useful, there is little to hand over.
• Orders to collect going forward. In some places authorities can order a provider to start collecting data about a particular user. Whether that is possible depends on the country and on the provider's technical design.

EU data retention: a short history

The EU is a useful case study because the rules moved. The Data Retention Directive (2006/24/EC) was adopted on 15 March 2006 and required member states to have telecom data retained for a minimum of six months and a maximum of twenty-four months, as summarized on Wikipedia. On 8 April 2014 the Court of Justice of the EU, in joined cases C-293/12 and C-594/12 (Digital Rights Ireland), declared the directive invalid for violating fundamental rights. The EUR-Lex page confirms the date and cases but our read of it did not show the outcome, so the invalidity point rests on Wikipedia.

The Court returned to the topic on 6 October 2020 (Privacy International; La Quadrature du Net and others). Its press release says EU law bars national laws that require general and indiscriminate retention or transmission of traffic and location data, including for national security. Exceptions exist: a state facing a serious national security threat that is "genuine and present or foreseeable" may order such retention, limited in time and subject to effective review by a court or binding independent body. Targeted retention for serious crime, expedited retention, and limited general retention of IP addresses and civil identity data are also permitted.

We did not check whether these EU rules reach VPN providers specifically; that turns on how covered services are defined and on each member state's law.

Why "no-logs" and location interact

A no-logs claim is a statement about what the company stores. Jurisdiction is about what the law can make it do. If a provider stores no connection or activity records, a demand for those records comes up empty. If its home-country law lets authorities compel logging, a no-logs policy could be overridden for that provider, at least on paper. A no-logs promise is only as strong as the evidence behind it. See what a no-logs policy really means, our audit report card, and the older audit analysis.

The "Eyes" alliances

VPN reviews warn about "Five Eyes," "Nine Eyes" and "Fourteen Eyes" countries. According to the NSA's page on the UKUSA Agreement, the United Kingdom and United States signed the BRUSA (now UKUSA) agreement on March 5, 1946, with arrangements for the other "Second Parties," Australia, Canada and New Zealand. Wikipedia adds that Canada joined in 1948 and Australia and New Zealand in 1956.

• Five Eyes: Australia, Canada, New Zealand, the United Kingdom and the United States, a group with a formal treaty basis in the UKUSA Agreement.
• Nine Eyes: the Five plus Denmark, France, the Netherlands and Norway.
• Fourteen Eyes: the Nine plus Belgium, Germany, Italy, Spain and Sweden. Wikipedia says the group is officially known as SIGINT Seniors Europe and was described in a document leaked by Edward Snowden.

The larger groupings are described as working arrangements, not the same kind of treaty as UKUSA, and we did not find their rules on VPN users. Being outside an alliance does not stop governments cooperating through ordinary legal channels, and being inside one does not mean a provider must log. Treat the labels as a small signal. Some governments push VPN providers directly to keep records or register; local rules are outlined in Is VPN legal?.

Two providers, read closely

Surfshark's privacy policy names Surfshark B.V. in Amsterdam, the Netherlands, as data controller. It says the company does not collect what users do online, including browsing history and connection timestamps, but that servers temporarily hold a user ID and/or IP address and timestamps for functionality, deleted within 15 minutes after the session ends. It says it discloses data to law enforcement or courts only when asked and legally obliged. The Netherlands is in the Nine Eyes list above, so the label alone tells you little. We could not read NordVPN's privacy policy page, so we state nothing about its controller or jurisdiction.

What audits can and cannot tell you

Both providers publish audit posts, in which each describes its own audit.

• NordVPN: a post dated February 3, 2026 says Deloitte Lithuania completed its sixth independent no-logs assurance engagement, with fieldwork from November 10 to December 12, 2025 and the report issued December 12, 2025. It covers several server types and the post calls it a point-in-time assessment. The report is not published in full; users can read it by logging in to their Nord Account.
• Surfshark: a post published June 16, 2025 and last modified September 28, 2026 says Deloitte performed an ISAE 3000 assurance engagement on its no-logs policy, covering standard, static and multiport servers. The post does not state the assessment date, and the report is available to users in their account.

In both cases the full report sits behind a login, so you rely on the provider's summary of an auditor the provider engaged. That is better than nothing and weaker than a public report, and an audit describes a past window, not today's servers.

What matters more than the map

Registration, server location and your own country can all differ. The longer discussion of corporate ties is in who really owns your VPN. If your concern is copyright exposure, jurisdiction does not make infringing downloads lawful; our article on torrenting legality and copyright notices looks at that limit.

A sensible way to choose

1. Start with what is logged, then read any audits for scope and date.
2. Check ownership and any history of legal demands.
3. Use jurisdiction to break ties.
4. Remember your goal. For public Wi-Fi, jurisdiction hardly matters. Against a government-level threat, a VPN alone is probably not enough. See VPN versus Tor.

Frequently Asked Questions