When your application necessitates your buyers to enter their info on their particular devices, then you qualify for SAQ A. The GDPR guards personal data whatever the know-how employed for processing that information. It's engineering neutral and relates to the two automatic and manual processing, presented the data is organised https://www.nathanlabsadvisory.com/blog/nathan/key-components-of-a-successful-incident-response-strategy/