Choose a VPN in Australia

What a VPN does and does not protect

ASD’s Australian Cyber Security Centre describes a virtual private network as a service that encrypts and secures your data when using the internet, and as an extra layer of protection on public Wi-Fi. That encryption runs between your device and the VPN service. It does not encrypt the rest of the internet, and it does not by itself prove who is at the other end of a website. ACSC, Connecting to public Wi-Fi and hotspots (last updated 11 Apr 2023; fetched 12 Sep 2026).

NIST SP 800-77 Rev. 1 describes IPsec as a network-layer control for protecting communications over IP networks. That is confidentiality and integrity of packets on a path, not anonymity, not malware removal, and not a substitute for authenticating the application you are using. NIST SP 800-77 Rev. 1 (June 2020; fetched 12 Sep 2026).

A personal VPN does not, on the public record we have:

• Stop phishing, account takeover, or a device that is already compromised.
• Replace HTTPS. ACSC still tells people to check for https and the lock icon on public Wi-Fi.
• Hide destinations from the VPN operator. ACSC says VPN providers have access to a large amount of their users’ data and tells buyers to read the privacy policy.
• Make you anonymous if you sign in to accounts, or if the operator retains account, payment or session metadata.
• Prove Australian data residency because a city exit is advertised.
• Satisfy the Privacy Act 1988 or the Australian Privacy Principles. Those rules apply to APP entities, not to a consumer choosing a browsing VPN. Inference from OAIC APP guidelines; this site is not a legal determination.

Threat models

ACSC’s public-Wi-Fi page is written for café, hotel, shop and airport hotspots: anyone can copy a network name; open networks are attractive for credential theft; a NSW case study describes a fake airport hotspot used to intercept identity documents. Tips on that page are: confirm the hotspot name with staff, disable auto-join, prefer a password-protected network, use HTTPS, set the network type to public, think twice before banking, and use a reputable VPN. Those tips sit beside MFA, updates, backups and antivirus — a VPN is one control, not the whole list. Same ACSC page.

ACSC’s 2025 seniors guide says to avoid public Wi-Fi when banking or shopping and to keep money-related activity for a home connection. Inference: a VPN on a café network is not presented as equivalent to a trusted home or mobile connection for banking. ACSC seniors guide (2025 PDF).

A different threat is remote access into an organisation. ACSC’s October 2021 Using Virtual Private Networks publication is about site-to-site and remote-access VPNs onto a network: separate VPN accounts, least privilege, MFA, device authentication, termination in a DMZ, disable split tunnelling on those organisational connections, and log authentication and sessions. That document is not a consumer-VPN shopping list. ACSC Using VPNs (October 2021 PDF). Essential Eight (patch applications and operating systems, MFA, restrict admin, and the rest) is still the organisation baseline. Essential Eight explained.

Personal VPN versus business remote access

This site keeps two collections. Personal VPN is a browsing-VPN list: logging claims, advertised exits, audits and billed subscription terms. Business remote access is private-resource access, overlays and ZTNA: seat minimums, identity controls and plan-dependent admin features. A consumer VPN tier is not evidence of SSO or access to company apps. Choose business VPN or private-resource access. Category: VPN.

Ownership and jurisdiction

Ownership here is the legal entity and Five Eyes status stored on the product record, not the exit-server map. Panama, Switzerland or Sweden is not “safe” as a slogan; the United States or Canada is not automatically “unsafe”. It is a jurisdiction fact you can read next to the privacy notice. Gibraltar (IVPN) and the British Virgin Islands (PureVPN) are recorded as Five Eyes unknown — a vendor blog is not a determination by this site. Reviews: IVPN, PureVPN.

Platform support is per app, not per brand

Kill switch, split tunnel and protocol lists are stored per operating system. A Windows yes is not an iOS yes. Examples from vendor documentation already on the reviews:

• IVPN removed the iOS kill switch for iOS 16+ because includeAllNetworks still leaked Apple-service traffic. IVPN blog, 1 Aug 2023. The Windows, macOS, Linux and Android apps still document a firewall.
• ExpressVPN documents WireGuard on iOS, Android and Windows. The Linux servers table does not list WireGuard. ExpressVPN review.
• Mullvad removed OpenVPN from the desktop app in 2025.14. In-app desktop protocol is WireGuard. Mullvad VPN review.

This page does not claim leak-test results. Missing a platform key is unknown, not unsupported.

Source-based selection criteria

Use documented fields, not marketing adjectives. For each requirement, unknown cannot satisfy it.

1. Family: personal browsing VPN or company-resource access.
2. The OS apps you actually use, including kill switch.
3. Jurisdiction and what account, payment and session data the privacy notice says is kept.
4. Audit row with an inspected report, not only an announcement.
5. Native billed currency. An FX equivalent is not an AUD SKU.
6. Intro billed total and renewal, not the effective-monthly teaser. VPN subscription cost tool.
7. Advertised Australian exits are a location claim, not data residency.

Worked example: café Wi-Fi traveller

Scenario (illustrative): an Australian adult who wants a personal browsing VPN on an iPhone and a Windows laptop, a documented kill switch on both, at least one inspected independent report, and a native AUD billed plan. Calculation clock 2026-09-12. Product last_verified dates stay on the research records.

Formula: cafe_pass = personal_vpn AND documented_ios AND documented_windows AND ios_kill_switch_yes AND windows_kill_switch_yes AND inspected_full_report AND native_aud_plan. Unknown cannot satisfy. An announcement-only audit is not an inspected report. This is a filter, not a ranking: 3 products currently pass.

Machine-readable formula and hand arithmetic: filter.json. Method: How we test.

12-month cash is the billed intro

Inference, not a vendor claim: the effective-monthly teaser times 12 is not the cash charged for a prepaid term. Hand checks on the stored intros: 349*12=4188 ≠ 9423 (Surfshark Starter 2-year, 27 covered months), 559*12=6708 ≠ 13416 (Proton VPN Plus 2-year, 24 months), 249*12=2988 ≠ 9711 (Private Internet Access 3 Years + 3 Months EXTRA, 39 months). Surfshark One is not used here (dual public intro). Same billed currency does not make the smaller listed total an Australian checkout ranking. GST and card FX fees are omitted.

Compare those SKUs in the cost tool.

Australian exit versus residency

Of 12 personal-VPN records, 12 advertise an Australian exit and 0 have data residency recorded as Australia. 12 have data residency unknown. An advertised exit IP is not Australian data residency.

Worked example: company apps from home

Scenario: a small Australian team that needs documented access to private company resources. Formula: office_pass = business_remote_access AND private_resource_access_yes. Personal-VPN products fail the family test. NordLayer’s private-resource access is plan-dependent, so it does not pass a hard yes. 3 products currently pass.

Decision checklist

• Write the threat: café Wi-Fi, account login, or company apps. Do not buy a consumer VPN for private-resource access.
• Check the OS apps you use, including kill switch. Do not assume iOS matches Windows.
• Read the privacy notice for retained account, payment and session data. A no-logs claim is not zero retained data.
• Prefer an inspected report PDF over a login-walled announcement.
• Budget the intro billed total and the named renewal, in the native currency. Confirm tax at checkout.
• Treat advertised Sydney or Melbourne exits as an IP location claim, not data residency.
• Keep MFA, updates and backups. ACSC does not present a VPN as a replacement for those controls.

Sources

• ASD’s ACSC, Connecting to public Wi-Fi and hotspots checked 2026-09-12
• ASD’s ACSC, Using Virtual Private Networks (October 2021) checked 2026-09-12
• ASD’s ACSC, Essential Eight explained checked 2026-09-12
• ASD’s ACSC, How to use the internet securely — a guide for seniors (2025) checked 2026-09-12
• NIST SP 800-77 Rev. 1, Guide to IPsec VPNs checked 2026-09-12
• OAIC, Australian Privacy Principles guidelines checked 2026-09-12
• IVPN, Removal of kill switch from the iOS app (1 Aug 2023) checked 2026-09-12
• Surfshark pricing (Starter 2-year billed total) checked 2026-09-11
• Proton VPN pricing (VPN Plus 2-year billed total) checked 2026-09-12
• Private Internet Access pricing (3 Years + 3 Months EXTRA) checked 2026-09-12