The legislation is restricted to incidents involving personal information credit card information credit eligibility and tax file number information that would put individuals at real risk of serious harm

Could you correct the punctuation please?
The legislation is restricted to incidents involving personal information, credit card information, credit eligibility, and tax file number information that would put individuals at "real risk of serious harm".