VPNs with servers in Bhutan

A UNODC e-evidence profile of Bhutan records no explicit domestic law imposing a mandatory retention period for electronic data. It cites the 2018 Act’s provisions letting the Authority require licensees to keep broadcast recordings for at least six months (ss. 187–189), and separately reports a six-month preservation provision for service providers, without naming it. Whether the Act or the Rules reach a VPN operator is not established.

The Authority’s Rules and Regulations on Content 2019 bind content providers not to disseminate content detrimental to the sovereignty, security, unity or stability of the nation, or content inciting religious, ethnic, regional or communal conflict, and prohibit sexually explicit content including pornography and nudity (rule 2.4.4).

The Penal Code (2011 text) makes it a misdemeanour for an internet service provider knowingly to act as host for pornographic material or as a channel for such an image (ss. 476(b), 477).

In the Penal Code’s 2011 text, defamation (s. 317) is intentionally damaging a person’s reputation by communicating false or distorted information; libel (s. 320) is defamation by writing, drawing or photographing. Each is graded a petty misdemeanour with compensation, or a fourth-degree felony where the matter includes murder, armed robbery, terrorism or treason (ss. 319, 321).

Computer offences include tampering with computer materials and unlawful possession of them (ss. 473–475) and computer pornography (ss. 476–477).

The Constitution provides that a person shall not be subjected to arbitrary or unlawful interference with privacy, family, home or correspondence, and that the State shall endeavour to protect telephonic, electronic, postal and other communications from unlawful interception or interruption.

For offences under the 2011 Anti-Corruption Act, the UNODC profile reports that interception needs a court order, unless evidence is in imminent danger of destruction, in which case judicial authorisation must follow within twenty-four hours. The order of the rows is the security score, and a server’s location is not a recommendation.