Retail and e-commerce under the Cyber Security and Resilience Bill
Retail is not a regulated sector under the Cyber Security and Resilience Bill (CSRB), so most retailers will not be directly regulated. The main exceptions are retailers running an online marketplace for other sellers, operating a large data centre, or providing managed IT services to others.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Why retail sits outside the core regime
The Cyber Security and Resilience Bill (CSRB) amends the NIS Regulations 2018. Schedule 2 of those regulations lists essential services in energy, transport, healthcare, drinking water and digital infrastructure, and the Bill adds data centres and large load controllers. Retail is not on the list.
The omission has been criticised, given the 2025 attacks on high street brands. The Cyber Monitoring Centre estimated the combined cost of the M&S and Co-op attacks at £270 million to £440 million. The government's own summary mentions retail only when pointing to free NCSC guidance for sectors outside the regime.
The routes that can still apply
| Route | When it could apply to a retailer | Test |
|---|---|---|
| RDSP (online marketplace) | Third-party sellers contract through your platform | Not a micro or small enterprise |
| Operator of essential services (data centre) | You run your own data centre for your business | Rated IT load of 10 MW or more |
| RMSP | You sell ongoing IT management to other businesses | Not a micro or small enterprise |
| Critical supplier | You supply directly to a regulated organisation and a regulator designates you | Disruption likely to have a significant impact on the economy or society |
Few retailers will meet any of these, though large groups should check marketplace and technology subsidiaries separately. A retail group's IT company that serves outside customers deserves particular attention.
How your suppliers' duties reach you
Even when you sit outside the Bill, the IT companies you rely on may not. Regulated managed service providers (RMSPs) and digital service providers (RDSPs) must, after giving their regulator a full notification, notify UK customers likely to be adversely affected. A notice must describe the incident and explain why the provider thinks you are affected.
That makes three things worth doing now:
- List which suppliers hold access to your systems, and which are likely to be regulated.
- Check that each contract names who receives incident notices, and that the mailbox is monitored.
- Decide who acts on a supplier notice, including whether it triggers your own UK GDPR assessment.
Other rules that already apply
Being outside the Bill does not remove your security duties. UK GDPR still requires appropriate security for customer data, and notification of qualifying personal data breaches to the regulator within 72 hours. Payment card rules and your insurer's conditions may also set requirements.
What to do
- Check whether any group company operates a marketplace or sells managed IT.
- Map suppliers likely to be regulated and review incident notice clauses.
- Use the scope checker to test each group company.
- Compare your incident plan with the 24-hour notification runbook. It is useful practice even if the duty does not apply to you.
Sources
Frequently asked questions
Not simply for being a retailer. Retail is not listed as an essential service. A retailer can still be caught through a separate activity, such as running an online marketplace that meets the size test.
Probably not, if you only sell your own goods. The definition covers a service letting consumers or traders conclude contracts with traders, on the marketplace site or on a trader site using its computing services. Letting third-party sellers trade on your platform may change the answer.
The Bill lets ministers specify further essential activities by regulations, after consultation, if they consider them essential to the economy or the day-to-day functioning of society. No specification for retail appears in the text.
On our reading, not as retail businesses, because retail is not a regulated sector. That is our interpretation of the Bill rather than an official statement.