Do cybersecurity rules apply to an online marketplace?

Name: ExploreWorldAI Engine
Price: 9 EUR
Availability: InStock

Short answer

Depends on size and sector. NIS2 names digital providers of a stated size, and the Chinese graded protection duties follow the network the marketplace operates.

Read against the registers 2026-08-26.

Who the role is

A platform where a third party sells to a buyer: the platform carries duties of its own, next to the seller's.

All duties for online marketplace

What the topic covers

All three regimes ask for measures, an incident report and a named accountable person. They differ in who is covered and how fast the report has to leave the building.

Cybersecurity duties compared: EU, United States and China

The rows behind the answer

European Union

NIS2 — Directive (EU) 2022/2555: Covers named essential and important entities, with management accountability and staged incident reporting.

United States

NYDFS Cybersecurity Regulation: Applies to entities licensed in New York: written programme, CISO reporting and 72 hour notification.
GLBA Safeguards Rule: Requires a written information security programme for financial institutions, with a qualified individual in charge.

China

Cybersecurity Law of the People's Republic of China: Sets graded protection duties, network operator obligations and incident response requirements.
Data Security Law of the People's Republic of China: Classifies data by importance and attaches handling and reporting duties to each class.

Where companies usually start

Map which entities in the group are in scope in each jurisdiction.
Write one incident procedure with the shortest applicable clock at the top.
Keep the evidence of measures in a form an auditor can read without a walkthrough.

This page reads published registers and describes common practice. It is not legal advice and it is not a compliance verdict.