How this links to the Cyber Security and Resilience Bill
Online marketplaces have been regulated as digital service providers since 2018. The Bill keeps the 2018 definition but recasts the category as a “relevant digital service”, and tightens the duties on Relevant Digital Service Providers: fixed 24 and 72-hour reporting to the Information Commission, customer notification, fuller registration and two penalty bands.
- cl.7(5): inserts “relevant digital service” into reg 1(2), meaning an online marketplace, an online search engine or a cloud computing service.
- cl.7(8), new reg 1(3)(e): an RDSP provides a relevant digital service in the UK, wherever established, and is not a micro or small enterprise, not a designated critical supplier for that service, and not exempt through public authority oversight.
- cl.8: amends the reg 12 security duty and requires RDSPs to have regard to Information Commission guidance (reg 12(2A)).
- cl.15, new reg 12A: initial notification within 24 hours and full notification within 72 hours, both from first awareness; cl.16, new reg 12C: notify affected customers.
- cl.14: amends reg 14 registration (proper address, 7-day change notices) and reg 14A UK representative duties.
What is the legal definition of an online marketplace?
Regulation 1(2) of the NIS Regulations 2018 defines an online marketplace as “a digital service that allows consumers and/or traders as respectively defined in point (a) and in point (b) of Article 4(1) of Directive 2013/11 to conclude online sales or service contracts”. The Bill does not change this wording, although clause 7(4) omits the separate definition of “digital service”.
The key feature is intermediation. A platform where independent traders sell to consumers, or where users book third-party service providers, fits. A retailer selling only its own stock through its own website is the trader, not the marketplace, and is not caught on that basis. The online marketplaces and search engines guide gives likely in and out examples.
Which marketplaces are exempt?
There is no sector-specific size or revenue threshold. Instead, a marketplace provider falls outside the RDSP definition in four situations under new reg 1(3)(e) and reg 1(3A).
- It is a micro or small enterprise under Commission Recommendation 2003/361/EC: broadly fewer than 50 staff and turnover or balance sheet total of €10m or less. There is no sterling conversion, and how group figures are aggregated is not settled.
- It is subject to public authority oversight and half or less of its income is commercial.
- It is designated as a critical supplier for that service under reg 14H.
- The service is a public electronic communications network or service.
What duties apply to a marketplace RDSP?
The marketplace must register with the Information Commission, manage risks to the network and information systems it relies on to provide the service (reg 12), report significant incidents within 24 and 72 hours from first awareness and copy them to the CSIRT (reg 12A), and notify customers likely to be affected (reg 12C). Providers with a principal office outside the UK must nominate a UK representative (reg 14A).
Under new reg 18, security duty and incident notification failures carry the higher maximum, the greater of £17m and 4% of turnover. Registration, UK representative and CSIRT copy failures carry the standard maximum, the greater of £10m and 2%.
Common misconceptions
Myth: Any ecommerce website is an online marketplace.
Reality: The definition covers services that let consumers or traders conclude contracts with traders. A single-brand shop selling its own goods is not a marketplace on that basis.
Myth: Marketplaces are a new category under the Bill.
Reality: They have been regulated digital services since the NIS Regulations 2018. The Bill renames the category and strengthens the duties.
Where it appears in the Bill
- NIS reg 1(2)2018 definition of online marketplace, not amended by the Bill.
- cl.7(5), (8), (9)Relevant digital service, the RDSP definition and exemptions, and the telecoms exclusion in reg 1(3A).
- cl.8, reg 12RDSP security duties and regard to Information Commission guidance.
- cl.15, new reg 12A; cl.16, new reg 12CIncident notification within 24 and 72 hours, and customer notification.
- cl.14, regs 14 and 14ARegistration and UK representative requirements.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
Is my ecommerce shop an online marketplace under the NIS Regulations?
Usually not, if you only sell your own stock. The NIS definition covers a digital service that allows consumers or traders to conclude online sales or service contracts with traders, which describes a platform connecting buyers with third-party sellers. You may still feel the Bill indirectly through contract terms from marketplaces or cloud providers you rely on.
Who regulates online marketplaces under the Cyber Security and Resilience Bill?
The Information Commission, which is the regulator for all Relevant Digital Service Providers. It keeps the register, receives incident notifications under regulation 12A and can issue guidance and penalties. The body was renamed from the Information Commissioner by the Data (Use and Access) Act 2025, and the Bill uses the new name throughout.
Are small online marketplaces exempt?
A marketplace provider that is a micro or small enterprise under Commission Recommendation 2003/361/EC is outside the RDSP definition. Broadly, that means fewer than 50 staff and turnover or balance sheet total of no more than €10 million. The Bill gives no sterling figure, and a small platform in a large group may not qualify once figures are aggregated.
Do overseas marketplaces serving UK users have to comply?
Yes, if they are in scope. The RDSP definition applies to a provider of a relevant digital service in the UK whether or not it is established here. A provider whose principal office is outside the UK must also nominate a UK representative in writing and notify the Information Commission of their details within three months.