Do cybersecurity rules apply to an online seller?

Name: ExploreWorldAI Engine
Price: 9 EUR
Availability: InStock

Short answer

Usually not through NIS2, which names sectors and sizes. Payment and financial rules can still carry a written security programme duty.

Read against the registers 2026-08-26.

Who the role is

A trader who sells to a consumer at a distance, on its own site or through a marketplace.

All duties for seller in distance selling

What the topic covers

All three regimes ask for measures, an incident report and a named accountable person. They differ in who is covered and how fast the report has to leave the building.

Cybersecurity duties compared: EU, United States and China

The rows behind the answer

European Union

NIS2 — Directive (EU) 2022/2555: Covers named essential and important entities, with management accountability and staged incident reporting.

United States

NYDFS Cybersecurity Regulation: Applies to entities licensed in New York: written programme, CISO reporting and 72 hour notification.
GLBA Safeguards Rule: Requires a written information security programme for financial institutions, with a qualified individual in charge.

China

Cybersecurity Law of the People's Republic of China: Sets graded protection duties, network operator obligations and incident response requirements.
Data Security Law of the People's Republic of China: Classifies data by importance and attaches handling and reporting duties to each class.

Where companies usually start

Map which entities in the group are in scope in each jurisdiction.
Write one incident procedure with the shortest applicable clock at the top.
Keep the evidence of measures in a form an auditor can read without a walkthrough.

This page reads published registers and describes common practice. It is not legal advice and it is not a compliance verdict.