Alternatively, hire a lawyer, like you would for any other regulatory requirement.
Far better details? It gives vague info on what might be considered personal data... I would not call it very detailed. In most cases just says personally identifiable information.
