A VPN incorporated in Panama operates under different legal obligations than one in the United States or the United Kingdom. Jurisdiction determines what laws apply, what data retention requirements exist, and what a government can legally demand from the company.
This matters because even a VPN with a genuine no-logs policy can be compelled to start logging in the future if it operates in a jurisdiction with mandatory data retention laws or broad surveillance authority.
The surveillance alliances to know
The Five Eyes (US, UK, Canada, Australia, New Zealand) is the most significant intelligence-sharing agreement. Members share surveillance data with each other and have historically pressured companies to cooperate with data requests.
The Nine Eyes adds France, Denmark, the Netherlands, and Norway. The 14 Eyes further expands to Germany, Belgium, Italy, Sweden, and Spain.
Being outside these alliances doesn’t make a VPN immune to surveillance, but it does mean fewer automatic data-sharing arrangements and different legal frameworks for compelled disclosure.
The best VPN jurisdictions
Panama: No data retention laws, not in any Eyes alliance, and no history of cooperating with foreign surveillance requests. NordVPN is incorporated here. Legal requests require going through Panamanian courts, which have no obligation to recognize foreign orders.
Switzerland: Not EU, not in any Eyes alliance, and home to some of the world’s strongest privacy legislation. ProtonVPN is Swiss. Swiss courts have a history of declining to enforce foreign data requests. The Federal Act on Data Protection sets strict standards.
Iceland: Outside the EU and all Eyes alliances, with strong constitutional privacy protections and no mandatory data retention. A small number of privacy-focused providers use Icelandic incorporation.
British Virgin Islands: Not a Five Eyes member, though it’s a British territory. ExpressVPN was historically incorporated here, which provided some separation from UK jurisdiction. With Kape’s ownership, the practical significance of BVI incorporation is diluted.
Romania: EU member, but has a history of striking down mandatory data retention directives and a relatively strong judiciary resistant to data requests. CyberGhost is incorporated here.
The worst jurisdictions for VPN privacy
United States: NSA surveillance, National Security Letters (which can compel data disclosure with a gag order), and a history of government pressure on tech companies. US-based VPNs include PIA, IPVanish, and StrongVPN.
United Kingdom: Investigatory Powers Act (“Snoopers’ Charter”) requires providers to retain connection metadata and grants broad government surveillance authority. No reputable privacy-focused VPN should be headquartered here.
Australia: Passed the Assistance and Access Act in 2018, which can compel companies to create backdoors in their products. Among the most aggressive surveillance laws in any democracy.
China: VPNs that operate here are required to maintain logs and provide data on demand. Any VPN with Chinese ownership or infrastructure should be treated with extreme caution.
Jurisdiction vs. no-logs policy: which matters more?
Both matter, but they work differently.
A no-logs policy determines what data exists today. If the logs don’t exist, there’s nothing to hand over regardless of jurisdiction.
Jurisdiction determines what can be compelled tomorrow. A US-based VPN with a genuine no-logs policy today could be served with a National Security Letter requiring them to start logging specific users, and they might be prohibited from disclosing that they’re doing so.
Panama and Switzerland are the strongest jurisdictions because they combine favorable privacy law with no automatic intelligence-sharing obligations. A provider based in either country, with a verified no-logs policy and RAM-only servers, faces the most barriers to being turned into a surveillance tool.
The corporate structure caveat
Jurisdiction of the VPN entity is not always the same as jurisdiction of the parent company. NordVPN is Panamanian but its parent Nord Security is Lithuanian (EU). ProtonVPN is Swiss and its parent Proton AG is also Swiss, which is a cleaner structure.
When evaluating jurisdiction, trace the full corporate chain. The VPN product’s incorporation matters, but so does where the employees, servers, and parent company are located.
Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.
Panama and Switzerland are the best jurisdictions for VPN privacy in 2026. NordVPN (Panama) and ProtonVPN (Switzerland) benefit from the strongest legal frameworks, outside all major intelligence alliances and without mandatory data retention requirements. Avoid US, UK, and Australian-based VPNs if jurisdiction is a concern. For most users, a strong no-logs audit matters more day-to-day than jurisdiction, but jurisdiction determines the long-term risk profile.
The jurisdictions, tiered for practical shopping
Collapsing the law into shopping tiers: the strong tier pairs no-retention law with no alliance membership, and its flagship examples are Panama (NordVPN), the British Virgin Islands (ExpressVPN) and Switzerland (Proton, with the statutory VPN carve-out that makes it arguably the strongest single flag). The middling tier covers EU and Fourteen Eyes democracies (Sweden’s Mullvad, the Netherlands’ Surfshark, Romania’s CyberGhost), where today’s law is workable and tomorrow’s is the question our EU data retention coverage tracks. The weak tier is Five Eyes cores (US, UK, Canada, Australia) where alliance plumbing and legal instruments run deepest; PIA’s court record shows architecture can compensate, and IPVanish’s 2016 history shows why the record matters.
The tier matters most at the margins of trouble: ordinary users never feel jurisdiction, while the targeted feel nothing else. Price the tier accordingly against your own situation.
How jurisdiction interacts with everything else
Flags don’t operate alone; they multiply against architecture and verification. Strong jurisdiction with no audits is a promise in a nice neighborhood; audits with weak jurisdiction (PIA) can still produce empty subpoenas; RAM-only fleets make any jurisdiction’s seizures less interesting; and anonymous accounts (Mullvad) shrink what any legal demand could even ask about. The combinations explain our table better than any single column: NordVPN and Proton lead because all four layers stack, not because Panama or Bern alone casts a spell.
The buyer’s heuristic that survives the legal nuance: prefer the strong tier when privacy drives the purchase, accept the middle tier when other scores justify it, and treat the weak tier as needing extraordinary evidence, which exactly one provider there has supplied.
The questions that pressure-test any flag
Three questions expose more than any map graphic. Has the jurisdiction’s law been tested against the provider (court cases, orders, seizures with documented outcomes)? Proton’s Swiss distinction, PIA’s US subpoenas and ExpressVPN’s Turkey seizure all answer with evidence; most flags answer with silence. Could the provider relocate if the law turned (and has it said so)? Stated relocation commitments matter precisely because laws drift. And does the company’s transparency report show requests arriving and failing? A report listing demands answered with nothing is jurisdiction theory made practice.
Ask those three of any provider and the marketing map resolves into an actual risk picture, which is the entire skill this article exists to transfer.
(Jurisdiction is one of the five trust layers our comparison scores; read it alongside audits, architecture, ownership and incident history, and no single column, this one included, has to carry the whole decision.)
The field evolves: the EU’s pending retention framework could redraw the middle tier within a few years, which is precisely why this article links to our running legislative coverage rather than pretending the map is finished. Check the tier, then check the news.
Keep reading: Five Eyes, Nine Eyes, 14 Eyes: What They Are and Why They Matter for VPN Users and Who Really Owns Your VPN? The Consolidation Map in 2026.