Resources Categories
INDUSTRY FACT FILE · RETAIL & E-COMMERCE
Market Landscape and the Drivers of Cybersecurity Demand in Retail and E-commerce
The business, technology, regulatory, legal and partner forces that create cybersecurity, audit and assurance work for retail chains, marketplaces, D2C brands, quick-commerce platforms and loyalty programmes.
|
In this document 1. Market landscape 2. Business drivers 3. Technology drivers 4. Regulatory drivers: CERT-In, RBI, PCI DSS, consumer protection and DPDP 5. Legal and statutory drivers 6. How the drivers differ by retailer type 7. What this means for buyers and for Codec Networks |
1. Market landscape
India's retail market is projected to reach about US$1.6 trillion by 2030, and digital channels are taking a growing share: e-commerce is projected to grow from roughly US$125 billion in 2024 to US$345 billion by 2030, online retail from US$75–85 billion in 2025 to US$170–180 billion by 2030, and quick commerce to US$65–70 billion by 2030. Global and Indian marketplaces, conglomerate retail arms, listed fashion and grocery chains, venture-backed D2C brands and quick-commerce platforms with thousands of dark stores compete for the same shopper, increasingly in tier-2 and tier-3 cities, and increasingly on the phone: UPI crossed 20 billion monthly transactions in August 2025.
Cybersecurity demand follows that growth and the incidents that have accompanied it. Payment partners require PCI DSS evidence and tokenisation, consumer regulators police interfaces and grievance handling, CERT-In expects six-hour reporting and independent audits, listed retailers disclose incidents, and the DPDP Act will make customer data a regulated asset. Spending is shifting from perimeter tools towards application and API testing, payment page controls, bot and DDoS resilience, fraud-aware monitoring and privacy engineering—most of it timed around the festive calendar.
|
US$1.6 tn India's projected retail market by 2030 |
20 bn UPI transactions in a single month (August 2025) |
Oct 2022 Card-on-file tokenisation became mandatory |
May 2027 Most DPDP obligations take effect |
|
Market segment |
Landscape and buying behaviour |
Cybersecurity opportunity |
|
Large marketplaces and quick-commerce platforms |
Engineering-led, API-first, peak-driven; formal security teams but vast partner and seller ecosystems |
Continuous testing, red teaming, bot and DDoS programmes, seller and partner risk, SOC |
|
Listed retail chains and conglomerate retail arms |
Store estates, POS, loyalty and growing apps; SEBI disclosure and Board scrutiny |
Store and POS assessments, segmentation, loyalty fraud controls, audits, SOC |
|
Omnichannel fashion and lifestyle retailers |
Unified commerce, franchise networks, high return rates |
ATO and refund logic testing, franchise access controls, privacy |
|
D2C brands |
Hosted platforms, plugins, agencies and 3PLs; small or no security teams |
Baseline storefront and cloud review, payment and privacy quick assessments |
|
Payments, loyalty and gift card operators |
Stored value, PA and PPI partnerships, card-network obligations |
PCI DSS, payment integration security, redemption controls |
2. Business drivers
|
Business driver |
Buying trigger |
Relevant services |
|
Festive-season revenue |
A checkout outage or bot attack during a sale loses a day of annual revenue |
Load and DDoS testing, bot management, SOC watch, war-room drills |
|
Customer trust and brand |
Data leaks and fake apps drive customers to competitors |
Privacy programme, brand monitoring, breach readiness |
|
Fraud losses |
Account takeover, loyalty, coupon, refund and gift card abuse erode margins |
ATO testing, fraud control reviews, fraud-aware monitoring |
|
Payment partner requirements |
Acquirers, aggregators and card networks require PCI DSS and tokenisation evidence |
PCI DSS readiness, payment integration reviews |
|
Board accountability and disclosure |
Listed retailers disclose incidents; investors ask about resilience |
Board advisory, incident records, audit programmes |
|
Marketplace and seller trust |
Sellers and brands expect platform security and data protection |
Seller portal testing, data governance, assurance reports |
|
Cyber insurance and investors |
Insurers and investors require MFA, backups and monitoring evidence |
Control validation, ransomware readiness reviews |
3. Technology drivers
|
Technology driver |
Exposure created |
Codec Networks opportunity |
|
Mobile apps and public APIs |
Business logic exposed to bots and attackers at scale |
API and mobile testing, bot management design |
|
Payment integrations and tokens |
Scripts and integrations around the payment page |
Payment page controls, integration reviews, PCI DSS scoping |
|
Cloud commerce, CDP and SaaS |
Misconfigured storage, leaked keys, excessive permissions |
Cloud posture, secrets management, SaaS reviews |
|
Dark stores, WMS and rider apps |
Hundreds of sites and devices with partner access |
Zero-trust partner access, segmentation, device controls |
|
POS and store networks |
Legacy terminals and flat store networks |
Store and POS assessments, segmentation |
|
AI chatbots, recommendations and agents |
Prompt injection, data leakage, automated abuse |
AI risk reviews and guardrail testing |
Figure 3: The four groups of drivers behind cybersecurity spending in retail and e-commerce.
4. Regulatory drivers: CERT-In, RBI, PCI DSS, consumer protection and DPDP
|
Instrument |
Key requirements |
|
CERT-In Directions (2022) |
Six-hour incident reporting; 180-day ICT logs in India; applies to bodies corporate including retailers and platforms |
|
CERT-In audit policy guidelines (July 2025) |
Risk-based, independent cyber audits covering applications, APIs, cloud and infrastructure |
|
RBI payment aggregator framework and PA Directions (2020, 2021, September 2025) |
Merchants may not store card credentials; aggregators verify merchant security; consolidated Directions cover online, cross-border and physical aggregators |
|
RBI card-on-file tokenisation (from October 2022) and PCI DSS v4.0.1 |
Tokens replace stored cards; cardholder data controls flow through acquirer contracts; payment page script controls since March 2025 |
|
Consumer Protection (E-Commerce) Rules 2020 and Dark Patterns Guidelines 2023 |
Grievance officer, nodal contact, disclosures and fair practices; thirteen dark patterns prohibited |
|
SEBI LODR Regulations (listed companies) |
Quarterly disclosure of cyber incidents in the corporate governance report |
|
DPDP Act 2023 and Rules 2025 |
Consent, safeguards, retention and breach intimation for customer, loyalty, seller and rider data; most obligations from May 2027 |
|
Confirm applicability Obligations depend on business model, payment arrangements, listing status and the data you hold. Confirm against the official instruments and your contracts. |
Figure 4: Regulatory and standards timeline shaping retail and e-commerce cybersecurity, as of October 2026.
5. Legal and statutory drivers
|
Law or obligation |
Relevance |
Demand created |
|
IT Act, 2000 and CERT-In Directions |
Incident reporting, logging and reasonable security practices |
SOC, logging, audits and incident response |
|
Consumer Protection Act, 2019 and E-Commerce Rules, 2020 |
Grievance handling, disclosures, fair practices and platform liability |
Platform governance reviews, policy support |
|
Dark Patterns Guidelines, 2023 |
Prohibited interface practices in apps and sites |
Consent and interface reviews |
|
Payment and Settlement Systems Act and RBI directions |
Aggregator, tokenisation and prepaid instrument rules |
Payment integration security, PCI DSS readiness |
|
DPDP Act, 2023 and Rules, 2025 |
Personal data of customers, loyalty members, sellers and riders |
Privacy programmes and breach workflows |
|
Legal Metrology Act and Packaged Commodities Rules |
Mandatory declarations on online listings |
Catalogue governance and integrity |
|
Companies Act, 2013 and SEBI LODR |
Board risk management and listed-company disclosure |
Board reporting, incident records |
6. How the drivers differ by retailer type
|
Retailer type |
Dominant business drivers |
Dominant technology drivers |
Principal regulatory drivers |
|
Marketplaces and quick commerce |
Peak revenue, seller trust, fraud |
APIs, bots, dark stores, partner access |
CERT-In, E-Commerce Rules, RBI PA, DPDP |
|
Retail chains |
Store continuity, loyalty, disclosure |
POS, store networks, loyalty platforms |
CERT-In, SEBI LODR, PCI DSS, DPDP |
|
Omnichannel and fashion |
Returns and refund fraud, brand |
Unified commerce, franchise systems |
CERT-In, E-Commerce Rules, DPDP |
|
D2C brands |
Growth, customer trust, investor diligence |
Hosted platforms, plugins, cloud CRM |
E-Commerce Rules, Legal Metrology, DPDP |
|
Payments and loyalty operators |
Stored-value fraud, partner obligations |
Token vaults, loyalty engines, wallets |
RBI PA/PPI rules, PCI DSS, DPDP |
7. What this means for buyers and for Codec Networks
|
Customer buying need |
Recommended offering |
Natural recurring engagement |
|
“Will our checkout survive the festive sale?” |
Festive-readiness programme: load, API and DDoS testing, bot management, runbooks |
Pre-season testing and peak SOC watch every year |
|
“Our payment aggregator and acquirer want PCI DSS evidence.” |
PCI DSS v4.0.1 scoping, gap assessment and payment page controls |
Annual assessment and quarterly reviews |
|
“Customers say their accounts and points were stolen.” |
Account takeover testing, identity and redemption control review |
Continuous fraud-aware monitoring |
|
“We need an independent audit of the platform.” |
CERT-In-aligned application, API and cloud audit |
Annual audits and retests |
|
“DPDP is coming—what do we do with our customer data?” |
DPDP gap assessment, data mapping, consent design |
DPO support and annual privacy reviews |
|
“Fake apps and sites are using our brand.” |
Brand monitoring and takedown service |
Continuous monitoring |
|
“Our partner or franchisee was breached—are we exposed?” |
Partner access review and third-party risk programme |
Per-partner assessments and renewals |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal or regulatory advice. Obligations differ by business model, size, listing status, payment arrangements and customers; confirm them against the official CERT-In, MeitY, RBI, Department of Consumer Affairs, SEBI and PCI SSC instruments and your payment partner and platform contracts.