In the old days, if you were a big company with multiple private local networks in multiple locations, you connected them together by installing private data lines between the various locations to make a Wide-Area Network. Then the Internet came along, and you also had to connect each site to the Internet.
It turns out that Internet feeds are much, much cheaper than private lines are, so inevitably people began asking "why can't I just connect these sites together with the Internet, and save money?"
The answer, of course, is that the Internet is a public network, so you don't want to send confidential company data over it. You could modify all your systems to encrypt their data when they talk to each other but that is likely to be complicated and expensive.
One solution was a technology called VPN. You tell each computer in the New York office that if it has anything for a computer in the London office that it should send it via a VPN gateway. The gateway is a machine connected to both the New York private local network, and to the public Internet. When it receive data for London it encrypts it and sends it over the Internet to another VPN gateway. The second gateway is connected to the public Internet and to the London private network, and when it receives the data from New York it decrypts it and drops it into the London network. The same thing happens to data going from London to New York, and if you open a Tokyo office you just install a third gateway and tell them about each other.
In this way, the machines in New York and London can talk to each other, but while the data is travelling over the public network it is encrypted and safe. You don't have to change anything about the machines that are talking, you just have configure your network routing tables, so everything works as if you had the expensive private WAN link.
This is Site-to-Site VPN. This idea was developed into Remote Access VPN.
An employee at home or travelling can connect their computer to the Internet and run a piece of software called a VPN client. When their computer has data to send to the New York office, the VPN client intercepts it, encrypts it, and sends it to the New York VPN gateway, which decrypts and drops the data into the New York network. In this way, the employee is able to safely access machines on the private New York network from anywhere they can get an Internet connection.
A further development has arisen more recently, called VPN as a Service.
Sometimes a person has data that they are OK to send over the Internet in general, but their local connection to the Internet is one that they specifically don't trust. Maybe they are in a sleazy Internet cafe and don't trust the owner, or they suspect the government has ordered their ISP to spy on them.
They can work around this problem by signing up with a VPN service provider. This works in the same way as the Remote Access VPN, with a local client installed on their machine encrypting data and sending it to a VPN gateway at the service provider. However, instead of accessing a private network, the service provider decrypts your packets and sends them out to the Internet over their connection, which you trust.
(This is why VPN service providers make a big deal of not logging traffic; if you suspect the Government has a warrant for your ISP, then they might also get a warrant for your VPN provider, so you want them to keep as little information about you as possible.)
There is another use for VPN as a Service. When you use it, the server you connect to sees a connection coming from the VPN provider, not from you. So, if the server you connect to only allows connections from a particular country (like many streaming video services do) you can bypass this restriction by using a VPN service that is in that country.
