The draft proposed article sets out objectives, scope and core definitions for the regulatory regime, identifying the regulated activities and persons and clarifying territorial application. It imposes substantive obligations on regulated entities, including duties of risk assessment, transparency to affected parties, data governance and security safeguards, record‑keeping and documentation of compliance measures, and requirements for contractual allocation of responsibilities where functions are outsourced.

Enforcement provisions confer powers on the designated supervisory authority to monitor compliance, require remedial measures, accept notifications and impose administrative sanctions and penalties. The text provides for reporting and cooperation duties, transitional arrangements, periodic review of the regime and mechanisms for regulatory guidance and delegated powers for technical standards.