A few things to add to Peter Buttler's and others' comments.
I am a frequent traveler. If I had (1) an unlimited data plan; (2) never used wifi for connecting to the internet outside my home network; and (3) had a recent, high quality router with encryption activated at home, I might feel ok without VPN.
Generally, data over a phone carrier is safe. The opposite is true of public wifi. I would never use public wifi without the protection of VPN. You are virtually guaranteed that in cafes, hotels, etc., your transmissions will often be intercepted. Look in Consumer Reports, AARP newsletters, etc., etc., for more warnings if you need them.
There are many VPN services free and paid. I have probably tried 10 or more. For a while, I used Private Internet Access (PIA) because one fee covered my PC laptop, iPhone, and iPad. Also, I was sold on the idea that they don't keep logs of your internet connections. As I later realized, this really only matters if you are afraid of a government investigation of your activities. I am not. If the NSA or other government agency wants to track me, they'll do it with or without VPN. What I care about is the non-government bad guys intercepting and reading my transmissions.
The problem with PIA was that it was very unreliable for the Apple devices. It would cut out without warning, or after waking from sleep, and I might not realize it for a while. The problem with some of the free VPNs is they may be difficult to set up and use. Could be ok for me, but not for others in my family. I needed something I could set up and forget on their devices.
After some trial and error, I found Cloak. It has an easy, "set and forget" app for iOs. When I first boot up, it will block my connection until it connects and activates. If it somehow drops the connection, it won't let me accidentally continue with an unprotected connection.
Of course, Cloak costs money. I pay $3/month on their mini plan. That allows unlimited devices and 5 gb data per month. It has been enough for me and my wife. Unlimited data bumps up to $8/month on an annual basis.
https://www.getcloak.com/plans-pricing/
I wish Cloak could be used on Windows. It is much better than PIA.
Final note: There are limitations on what any VPN can and cannot do. Many VPN providers overstate (at least, by implication if not outright misrepresentation) the protection you get. I appreciated the Cloak FAQ explaining those limitations. https://support.getcloak.com/faq/introduction-cloak-vpns/#how-does-cloak-work-un der-the-hood
See also their explanation of the difference between security, privacy, and anonymity.
https://blog.getcloak.com/2015/03/30/security-privacy-anonymity/
