If the application requires your clients to enter their info on their own personal products, You then qualify for SAQ A. This allows all organizations—from significant firms to startups and little and medium enterprises, which may not contain the requisite security infrastructure and workers—to stay guarded and PCI DSS compliant. https://www.nathanlabsadvisory.com/certified-data-privacy-professional-cdpp.html