Resources Categories
INDUSTRY FACT FILE · RETAIL & E-COMMERCE
Industry Overview: Retail and E-commerce in India
Who sells to India's consumers in stores, on apps and through marketplaces, the consumer, payment, data and cyber obligations that apply, who buys cybersecurity and why each type of retailer needs a distinct approach.
|
In this document 1. Why retail and e-commerce cybersecurity matters now 2. The ecosystem at a glance 3. Categories of retail and e-commerce companies 4. The consumer, payment, data and cyber framework at a glance 5. Government, platform and private participants 6. Who buys cybersecurity inside a retailer or marketplace 7. Why each type of retailer needs a different approach 8. How Codec Networks works with retailers and platforms |
|
Sector scope Sector: retail chains and supermarkets, online marketplaces, D2C brands, quick commerce, omnichannel and fashion retailers, consumer electronics retail, and payment, loyalty and gift card programmes. Primary service proposition: web, mobile and API VAPT, payment integration security, privacy, brand protection and SOC. Payments processors, logistics, FMCG and hospitality have separate fact files. |
1. Why retail and e-commerce cybersecurity matters now
India's retail market is among the largest in the world and is projected to reach about US$1.6 trillion by 2030, with organised and online retail taking a growing share. E-commerce alone was estimated at about US$125 billion in 2024 and is projected to reach roughly US$345 billion by 2030; online retail is expected to more than double from US$75–85 billion in 2025 to US$170–180 billion by 2030, and quick commerce—ten-minute delivery from dark stores—has become the fastest-growing segment, with the leading platform operating more than 1,300 dark stores and processing over 400 million orders in the 2025 financial year. The 2025 festive season alone was projected to generate more than ₹1.15 lakh crore of online gross merchandise value, with about ₹25,000 crore sold in the first two days of the big platform sales.
|
US$345 bn India's projected e-commerce market by 2030 (IBEF) |
59% Of retail web traffic is malicious bots (Imperva, 2025) |
£300 m Estimated profit impact of the 2025 Marks & Spencer attack |
6 hours To report cyber incidents to CERT-In |
That commerce runs on software. Storefront websites and mobile apps, public and partner APIs, payment gateway, UPI, BNPL and tokenisation integrations, order and warehouse management systems, point-of-sale terminals, loyalty and gift card platforms, CRM and customer data platforms, cloud hosting and dozens of third-party scripts, plugins and SaaS tools together make up a retailer's attack surface. UPI processed more than 20 billion transactions in August 2025, and most of those shoppers never meet a human—they trust an app. Attackers follow that trust: bad bots made up 59% of retail web traffic in Imperva's 2025 Bad Bot Report, credential stuffing turns leaked passwords into loyalty and refund fraud, and skimming scripts quietly copy card details from checkout pages.
The consequences are visible. In April 2025, a ransomware attack on Marks & Spencer—linked to the Scattered Spider group and reportedly introduced through a contractor—halted online orders for weeks and led the company to estimate an operating profit impact of around £300 million; the Co-op's related incident was assessed at about £206 million in lost revenue. In 2018, Magecart skimming code on British Airways' website and app harvested the details of more than 400,000 customers and led to a £20 million ICO fine. In 2013, attackers entered Target through an HVAC vendor's credentials and stole about 40 million card records, costing the retailer more than US$200 million. In India, about 20 million BigBasket customer records were reported leaked in November 2020, Domino's India confirmed a March 2021 attack after data from roughly 18 crore orders appeared online, Juspay disclosed that about 35 million masked card records were taken through an old cloud access key in August 2020, and in April 2024 the personal data of about 7.5 million boAt customers was posted on a hacking forum.
In India the obligations are layered. CERT-In's Directions require cyber incidents to be reported within six hours and ICT logs to be retained for 180 days, and its 2025 audit policy guidelines expect risk-based independent audits of applications, cloud and infrastructure. RBI's payment aggregator framework forbids merchants from storing customer card credentials, card-on-file tokenisation has applied since 1 October 2022, and the consolidated Payment Aggregator Directions of September 2025 tighten merchant due diligence; PCI DSS v4.0.1's future-dated requirements, including payment page script controls, have applied since March 2025. The Consumer Protection (E-Commerce) Rules, 2020 require grievance officers, disclosures and fair practices, the CCPA's 2023 guidelines prohibit dark patterns, listed retailers disclose cyber incidents quarterly under SEBI's LODR Regulations, and the DPDP Act and Rules will govern customer, loyalty, seller and rider data, with most obligations taking effect in May 2027.
|
Key takeaway In retail and e-commerce, cybersecurity is revenue continuity, payment integrity and customer trust in one. The storefront, the checkout, the customer account, the partners connected to the platform and the data behind personalisation must be protected together—and tested before every peak. |
2. The ecosystem at a glance
Figure 1: India's retail and e-commerce ecosystem.
3. Categories of retail and e-commerce companies
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Retail chains and supermarkets |
Grocery, hypermarket, department and value chains with hundreds of stores, POS estates and loyalty programmes |
Listed and private groups, conglomerate retail arms |
CERT-In; SEBI LODR (listed); Legal Metrology; DPDP; PCI DSS via acquirers |
|
Online marketplaces |
Multi-seller platforms for general merchandise, fashion, electronics and groceries |
Global and Indian platform companies, listed and private |
E-Commerce Rules 2020; FDI policy (Press Note 2 of 2018); CERT-In; DPDP; RBI PA rules |
|
D2C brands |
Digitally native brands selling through their own storefronts, marketplaces and social commerce |
Venture-backed and founder-led private companies |
E-Commerce Rules 2020; Legal Metrology; CERT-In; DPDP |
|
Quick commerce |
Ten-to-thirty-minute delivery from dark stores through rider fleets |
Platform companies, some listed through parents |
E-Commerce Rules 2020; CERT-In; DPDP; labour and food-safety rules |
|
Omnichannel, fashion and lifestyle retailers |
Stores plus apps, click-and-collect, endless aisle and franchise networks |
Listed and private retailers, brand licensees |
CERT-In; SEBI LODR (listed); DPDP; PCI DSS |
|
Consumer electronics and durables retail |
High-value stock sold with EMI, BNPL and exchange offers |
Listed and private chains, brand stores |
CERT-In; DPDP; RBI rules through lenders and PAs |
|
Payments, loyalty and gift card programmes |
Retailer wallets, co-branded cards, points, stored value and coalition loyalty |
Retailers with PA, PPI or bank partners |
RBI PA, PPI and tokenisation rules; PCI DSS; DPDP |
|
Retail technology and fulfilment partners |
Commerce SaaS, POS, OMS/WMS, couriers and 3PL serving retailers |
Private technology and logistics companies |
CERT-In; customer contracts; DPDP as processors |
4. The consumer, payment, data and cyber framework at a glance
|
Instrument or expectation |
What it means for retailers and platforms |
|
CERT-In Directions (28 April 2022) |
Cyber incidents reported within six hours of noticing them; ICT logs kept for a rolling 180 days in India; clock synchronisation; designated point of contact |
|
CERT-In audit policy guidelines (25 July 2025) |
Risk-based, independent cyber audits covering applications, APIs, cloud and infrastructure, with closure of findings |
|
RBI payment aggregator framework (2020, 2021, PA Directions September 2025) |
Merchants onboarded by payment aggregators may not store customer card credentials; aggregators verify merchant security; consolidated 2025 Directions cover online, cross-border and physical PAs |
|
RBI card-on-file tokenisation (from 1 October 2022) |
Clear card numbers, CVVs and expiry dates may not be stored by merchants or aggregators for online transactions; tokens replace stored cards |
|
PCI DSS v4.0.1 (card networks and acquirers) |
Cardholder data security for any entity that stores, processes or transmits card data; future-dated requirements since 31 March 2025 include payment page script inventory and tamper detection |
|
Consumer Protection Act 2019; E-Commerce Rules 2020; Dark Patterns Guidelines 2023 |
Grievance officer and nodal contact, disclosures of sellers and charges, no price manipulation or unfair practices; thirteen dark patterns such as false urgency and basket sneaking prohibited |
|
SEBI LODR Regulations (listed companies) |
Cyber security incidents, breaches and loss of data disclosed in the quarterly corporate governance report since July 2023 |
|
DPDP Act 2023 and DPDP Rules 2025 |
Notice, consent, safeguards, retention limits and breach intimation for customer, loyalty, seller, rider and employee personal data; most obligations from May 2027 |
|
Legal Metrology and FDI e-commerce policy |
Mandatory declarations on online listings since January 2018; marketplace-model conditions for foreign-funded platforms under Press Note 2 of 2018 |
|
How these apply Payment obligations flow through acquirer, aggregator and card-network contracts; consumer rules depend on whether you are a marketplace or inventory seller; cyber and data obligations are cross-sector. Confirm against the official instruments and your contracts. |
5. Government, platform and private participants
- The Department of Consumer Affairs and the Central Consumer Protection Authority administer the Consumer Protection Act, the E-Commerce Rules and the dark-pattern guidelines; Legal Metrology enforces declaration rules.
- DPIIT sets FDI policy for e-commerce and sponsors ONDC, the open network launched as a pilot in April 2022 that crossed 200 million cumulative transactions by March 2025.
- RBI and NPCI govern payment aggregators, tokenisation, prepaid instruments and UPI; card networks and acquiring banks carry PCI DSS obligations into merchant contracts.
- MeitY and CERT-In set cyber obligations; SEBI governs disclosure by listed retailers; the Data Protection Board will enforce the DPDP Act.
- Marketplaces, quick-commerce platforms, retail chains and D2C brands operate the storefronts; commerce SaaS, POS, OMS/WMS and marketing vendors build the platforms they run on.
- Payment aggregators, BNPL providers, couriers, 3PLs and dark-store franchisees connect in through APIs and remote access, and are the most common third-party path into a retailer.
6. Who buys cybersecurity inside a retailer or marketplace
|
Stakeholder |
What they care about |
What they buy |
|
Board, CEO and CFO |
Festive-season revenue, fraud losses, disclosure, brand damage |
Board advisory, resilience programmes, crisis exercises |
|
CTO, CIO and CISO |
Platform security, audits, payment partner requirements |
VAPT, audits, SOC, DevSecOps programmes |
|
Head of engineering and product |
Release velocity, app and API security, peak readiness |
API testing, secure SDLC, load and DDoS testing |
|
Payments and finance |
Gateway integrations, tokenisation, chargebacks, PCI DSS |
Payment integration reviews, PCI DSS readiness |
|
Fraud, risk and trust & safety |
Account takeover, bots, loyalty and refund abuse |
ATO testing, bot management, fraud control reviews |
|
Marketing, CRM and loyalty |
Customer data, consent, campaigns, fake promotions |
Privacy programmes, brand monitoring, takedowns |
|
Operations, stores and fulfilment |
POS, dark stores, WMS, rider apps, partner access |
Store and WMS assessments, partner access reviews |
|
Legal, compliance and company secretarial |
E-Commerce Rules, DPDP, SEBI disclosure |
Gap assessments, incident records, disclosure support |
7. Why each type of retailer needs a different approach
|
Retailer type |
Highest-consequence risk |
Starting point for assurance |
|
Retail chain or supermarket |
Ransomware across POS, stores and distribution; loyalty database theft |
Store and POS assessment, segmentation, SOC, loyalty fraud controls |
|
Online marketplace |
API abuse, bots and DDoS at peak; seller and customer data exposure |
API and business-logic testing, bot and DDoS readiness, seller risk |
|
D2C brand |
Platform plugin or script compromise; customer database leak |
Storefront and script review, cloud posture, privacy baseline |
|
Quick-commerce platform |
Ransomware or partner compromise stopping dark stores and riders |
Zero-trust partner access, WMS segmentation, backups, SOC |
|
Omnichannel or fashion retailer |
Account takeover and refund fraud across channels |
ATO testing, identity controls, returns and refund logic review |
|
Payments, loyalty or gift card programme |
Stored-value fraud and card data exposure |
Payment integration security, PCI DSS, redemption controls |
8. How Codec Networks works with retailers and platforms
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For retailers and platforms we deliver web, mobile and API VAPT with business-logic testing, payment integration and payment page security reviews mapped to PCI DSS v4.0.1 and RBI rules, DPDP privacy programmes for customer and loyalty data, brand and fraud protection including fake-app and domain takedowns, bot, DDoS and festive-readiness testing, 24x7 retail SOC and crisis exercises—connected from finding to closure and planned around your sales calendar.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal or regulatory advice. Obligations differ by business model, size, listing status, payment arrangements and customers; confirm them against the official CERT-In, MeitY, RBI, Department of Consumer Affairs, SEBI and PCI SSC instruments and your payment partner and platform contracts.