E-commerce · NIS2

E-commerce — NIS2: the case of marketplaces

NIS2 classifies online marketplaces as digital service providers. Beyond the size threshold, they fall under important entities and must structure their cybersecurity accordingly. A standard e-commerce store is primarily concerned indirectly. This guide clarifies the classification, the required measures, and the notification obligations.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: NIS2.
  • Marketplaces exceeding the threshold are concerned as important entities.
  • Applying the measures of Article 21.
  • Securing the supply chain.
  • Notify incidents.
  • For important entities, up to €7 M or 1.4% of global turnover.

Regulatory deadlines

The key dates of this regulation.

January 2023

Entry into force (EU directive)

In force

October 2024

Transposition deadline (EU)

In force

2026

French transposition (Resilience Act)

In force

What does NIS2 cover?

NIS2 classifies online marketplaces as digital service providers. Above the 'medium entity' threshold, they qualify as important entities subject to the measures under Article 21 and to incident notification requirements.

A standard online shop is not a digital service provider in the same sense, but depends on the security of its service providers.

Is the 'E-commerce' sector affected?

Marketplaces exceeding the threshold are concerned as important entities. Third-party sellers and service providers are involved through the supply chain.

A own store below the threshold is affected mainly indirectly.

Detailed obligations

Apply the measures of Article 21

Security policy, incident management, access control, encryption, multi-factor authentication.

Secure the supply chain.

Governing the hosting provider, payment processor and third-party integrations.

Notify incidents

Early warning followed by reports within deadlines.

Ensure continuity

Continuity plans for a high-availability online service.

Govern

Involve senior management.

Sanctions & risks

For important entities, up to €7M or 1.4% of global turnover. An incident on a marketplace affects numerous sellers and buyers.

Application timeline

  • 1Directive. Adopted end of 2022.
  • 2France. Transposition in progress; marketplaces should anticipate.

Common mistakes in the sector

  • 1Undetermined status. Failing to determine whether you qualify as a digital service provider.
  • 2Unsecured chain. Leaving third-party integrations ungoverned.
  • 3No continuity. Neglecting service availability.
  • 4Absent leadership. Limiting security to technical measures.

Practical case

A marketplace exceeding the relevant threshold structures its NIS2 compliance by rolling out MFA across the board, governing its payment service provider and integrations, and formalising its incident notification and business continuity procedures.

Compliance roadmap

  1. 1

    Qualify. Determining whether you are a targeted marketplace.

  2. 2

    Secure. Deploy the measures of Article 21.

  3. 3

    Chain. Govern hosting and payment.

  4. 4

    Continuity. Prepare for high availability.

  5. 5

    Notify. Tool up alerting.

Frequently asked questions

A marketplace yes (above the threshold); a standard online shop is primarily affected indirectly.

Back to the E-commerce guideE-commerce & GDPR

Take action on NIS2

Free assessment or a chat with an expert dedicated to e-commerce.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the e-commerce sector secured their compliance with DCO.

See testimonials