This looks like the mirror image for the requirements document for protecting PII. You may not need to be able to respond directly to every demand in the letter, but you should be able to have a watertight explanation of why not. "Burdensome" won't cut it.