EU introduces first official security standards for the VPN industry

The European Telecommunications Standards Institute (ETSI) has developed the world’s first official security standard for VPNs, known as EN 304 620. This standard is designed to support the European Union’s Cyber Resilience Act, a landmark law establishing mandatory security requirements for digital products.

Developed in collaboration with industry players including Surfshark, ZTE Corporation, Palo Alto Networks, Google, and Nord Security, the standard aims to provide actionable rules for data privacy and security. Miguel Fornés, Information Security Manager at Surfshark, served as a contributing technical expert in the process.

The standard is scheduled to become public in August, while the Cyber Resilience Act will be enforced starting December 11, 2027. Non-compliance with the regulation can result in significant fines, reaching up to EUR 15,000,000 or 2.5% of a company’s total worldwide annual turnover.