The draft proposed article establishes a legal framework setting out its purpose, scope and key definitions, and identifies the classes of organisation and activity to which it applies. It prescribes substantive obligations for regulated entities, including requirements for risk assessment, governance and internal controls, record‑keeping, transparency and reporting, data handling and security, and obligations on senior persons; it also provides for model clauses and standards to be prescribed or annexed.

The draft specifies supervisory and enforcement arrangements, including powers of inspection, information‑gathering, remedial directions, sanctions and penalties, and procedures for appeals and review. It includes transitional arrangements, commencement provisions, and periodic review mechanisms, and allows for secondary instruments to amend technical details and enforcement processes.