In case your application involves your customers to enter their info on their own equipment, Then you definitely qualify for SAQ A. The GDPR guards personalized information regardless of the technology useful for processing that knowledge. It is technological know-how neutral and applies to both equally automatic and handbook processing, https://www.nathanlabsadvisory.com/blog/author/nathan/page/4/