In case your application needs your clients to enter their info on their own gadgets, Then you definately qualify for SAQ A. The GDPR protects personalized info whatever the know-how useful for processing that data. It's technological know-how neutral and applies to each automated and manual processing, delivered the info https://www.nathanlabsadvisory.com/cyber-security-policy-review.html