There is a lot of use in the bill of the word 'proportionate', which I think can do a lot of work.
Subsection (6) specifies that whether steps, systems and processes are
proportionate is determined by the levels of risk identified in the risk assessment and
the service provider’s size and capacity. In practice, this means that the expectations
will be different for a large, high risk service compared to a small, low risk service.
There is a lot of use in the bill of the word 'proportionate', which I think can do a lot of work.