Cyber Security and Resilience Bill: Online Marketplaces and Search Engines

Yes. Online marketplaces and online search engines have been regulated as digital service providers since the NIS Regulations 2018 came into force. The Cyber Security and Resilience Bill (HL Bill 32) does not bring them into scope for the first time. It updates the regime they are already in.

Clause 7 renames the category "relevant digital service", defined as "an online marketplace, an online search engine or a cloud computing service", and replaces the old digital service provider test with the RDSP test in new regulation 1(3)(e). The existing definitions of online marketplace and online search engine are left unchanged.

The real changes are to the duties: a clarified security duty (clause 8), fuller registration and UK representative requirements (clause 14), a new 24-hour and 72-hour reporting regime (clause 15), a customer notification duty (clause 16) and a new two-band penalty structure (clause 21). Until those provisions commence, the government's RDSP factsheet says providers should keep complying with the NIS Regulations as they stand.

"online marketplace" means a digital service that allows consumers and/or traders as respectively defined in point (a) and in point (b) of Article 4(1) of Directive 2013/11 to conclude online sales or service contracts with traders either on the online marketplace's website or on a trader's website that uses computing services provided by the online marketplace

NIS Regulations 2018, regulation 1(2)

Three features matter. First, the service intermediates: buyers conclude contracts with traders, not with the platform as seller. Second, it covers both sales and service contracts, so booking and services platforms can fall within it as well as goods marketplaces. Third, the second limb reaches platforms that supply computing services to a trader's own website through which contracts are concluded.

The Directive 2013/11 reference (the EU alternative dispute resolution directive) is how the definition imports its meaning of "consumer" and "trader". Where a service sits at the edge, such as a shop-builder or a classified listings site, the answer turns on the facts and on guidance from the Information Commission.

"online search engine" means a digital service that allows users to perform searches of, in principle, all websites or websites in a particular language on the basis of a query on any subject in the form of a keyword, phrase or other input, and returns links in which information related to the requested content can be found

NIS Regulations 2018, regulation 1(2)

The key words are "in principle, all websites" and "a query on any subject". A general web search engine is in. So is one limited to websites in a particular language. A search tool that only indexes one organisation's own pages, or a single product catalogue, does not search all websites and is not an online search engine under this definition.

Yes. New regulation 1(3)(e)(i), inserted by clause 7(8), makes a person an RDSP if it provides a relevant digital service in the United Kingdom "whether or not the person is established in the United Kingdom". What matters is providing the service in the UK, not where the company sits.

Regulation 14A, as amended by clause 14(3) to (8), then applies to any RDSP with its principal office outside the UK. Such an RDSP must:

• Nominate in writing a representative in the United Kingdom
• Notify the Information Commission of the representative's name and contact details, including an email address and telephone number
• Do so within 3 months of the provision commencing, or of first becoming an RDSP to which regulation 14A applies
• Notify changes within 7 days (from the change for a new representative, or from becoming aware for changed contact details)

The Information Commission or GCHQ may contact the representative instead of, or as well as, the RDSP. Failing to comply with regulation 14A falls in the standard penalty band.

New regulation 1(3)(e) excludes a provider from being an RDSP in four situations:

• Micro or small enterprise: excluded if it is a micro or small enterprise as defined in Commission Recommendation 2003/361/EC (reg 1(3)(e)(iii))
• Public authority oversight: excluded if it is subject to public authority oversight and derives half or less of its income from commercial activities (reg 1(3)(e)(iv), with oversight defined in reg 1(3E), inserted by clause 11)
• Critical supplier: excluded for a service in respect of which it is designated as a critical supplier under regulation 14H (reg 1(3)(e)(ii))
• Telecoms: providing a public electronic communications network or service is not a relevant digital service (reg 1(3A), inserted by clause 7(9))

Public authority oversight means management or control by UK public authorities, or by a board more than half of whose members they appoint. A publicly controlled provider earning more than half its income commercially stays in scope.

The examples below are illustrations only, not legal advice. Each assumes the provider serves UK users and is not publicly controlled or designated as a critical supplier.

Businesses that are out can still feel the Bill. In-scope platforms and cloud providers will manage supply chain risk and are likely to flow security and incident-reporting obligations down into contracts with sellers and suppliers.

Register with the Information Commission. Regulation 14, as amended by clause 14(2), requires an RDSP to register within 3 months of the provision commencing or of first meeting the RDSP conditions. It must give its proper address, the names of its directors (or partners), and which relevant digital services it provides. Changes must be notified within 7 days.

Manage security risks. Regulation 12(1) requires an RDSP to take appropriate and proportionate measures to manage risks to the network and information systems it relies on to provide its service in the UK. Clause 8 makes clear that measures must prevent and minimise the impact of incidents on the security of those systems, not just on service continuity, and the RDSP factsheet confirms the duty extends to third-party systems the service relies on. RDSPs must have regard to Information Commission guidance (new reg 12(2A)).

New regulation 12A, inserted by clause 15(5), sets two deadlines. Both run from the time the RDSP is first aware that an RDSP incident has occurred or is occurring:

• Initial notification within 24 hours: the RDSP's name, the service affected and brief details
• Full notification within 72 hours of the same moment: timing, duration, nature, impact including cross-border impact, and any linked incident at another regulated person
• A copy of each notification to the CSIRT at the same time as the Information Commission
• Notifications in writing, in the form and manner the Information Commission determines

An incident is reportable if it has affected or is affecting the operation or security of the systems relied on to provide the service and its UK impact is, or is likely to be, significant. Regulation 12A(3) lists the factors, including disruption, number of users affected, duration, geography, compromise of user data, impact on users' own systems, and wider economic or societal impact. Numeric significance thresholds will come in secondary legislation.

Yes. New regulation 12C, inserted by clause 16(3), applies once the RDSP has given its full notification. It must, as soon as reasonably practicable, take reasonable steps to identify which UK customers are likely to be adversely affected, and then notify them.

In deciding who is affected, it must consider disruption to the service it provides to that customer, likely compromise of the customer's data, and any other impact on the customer's own systems. Each notice must describe the incident and explain why the customer is likely to be affected. For a marketplace, affected customers may include both sellers and buyers. Separately, the Information Commission can direct an RDSP to inform the public under regulation 12B(4)(b).

Clause 21 replaces the penalty provisions in regulation 18 with two bands, each expressed as a greater-of figure for undertakings:

These are maximums set as floors, not caps: for a large platform the percentage figure will usually be higher. The 10% of turnover and daily penalty figures sometimes quoted do not apply to the RDSP regime: they belong to Part 4 national security directions and, for the 10% cap, to future Part 3 regulations.

Lords Committee Stage on HL Bill 32 sat on 1, 3, 7 and 9 September 2026. Report Stage is next, with no date announced, and Royal Assent is expected between late 2026 and spring 2027. The RDSP changes then commence through secondary legislation, which is expected to run towards 2028. No commencement date has been set. Once they commence, the factsheet says existing RDSPs will have three months to provide updated registration information, but must meet the security and reporting duties from day one.

A marketplace or search engine below the size threshold is not an RDSP, but it is not necessarily untouched. The RDSP factsheet notes small providers may be designated as critical suppliers under regulation 14H if they meet the designation criteria. Customer contracts may impose equivalent controls, and Part 4 directions can apply to regulated persons.

• Cyber Security and Resilience (Network and Information Systems) Bill: UK Parliament bill page
• Read HL Bill 32 (PDF): clauses 7, 8, 11, 12, 14, 15, 16 and 21
• GOV.UK factsheet: Relevant digital service providers
• GOV.UK factsheet: Incident reporting
• GOV.UK factsheet: Enforcement
• Information Commission: Guide to NIS
• The Network and Information Systems Regulations 2018, regulation 1 (definitions)

• Cloud service providers and RDSPs
• Large SaaS providers
• Critical suppliers
• AI companies
• The Cyber Security and Resilience Bill 2026: a definitive analysis
• Lords Second Reading complete: key themes and Committee Stage
• AI scope at Lords Committee
• What the Bill changes
• Cyber Security and Resilience Bill FAQ