Definition
A VPN provider's jurisdiction is the country whose laws apply to its corporate operations. This is determined primarily by where the company is incorporated, where it physically operates servers, and where its key personnel reside. Different jurisdictions have very different rules about what data providers must retain, when they must hand it over to authorities, and whether they can warn affected users that a request was made.
Privacy-Friendly vs Privacy-Hostile Jurisdictions
Often-praised jurisdictions include Switzerland (strong privacy laws, not in any Eyes alliance), Panama, Iceland, Romania, and the British Virgin Islands. Often-flagged jurisdictions include the Five Eyes (US, UK, Canada, Australia, New Zealand), the broader Fourteen Eyes, China, Russia, and Iran. The reality is more nuanced than the labels suggest — Switzerland has its own surveillance laws — but the labels capture the broad strokes.
What Jurisdiction Can and Cannot Do
Jurisdiction determines what a provider can be forced to do, but it does not determine what they have. A no-logs provider in a hostile jurisdiction can be ordered to log going forward but cannot retroactively hand over what they did not keep. A logs-friendly provider in a friendly jurisdiction is still risky, because their own records exist regardless of legal demands. The strongest stance combines a privacy-friendly jurisdiction with audited, RAM-only no-logs architecture.