When your application demands your buyers to enter their info on their very own products, Then you certainly qualify for SAQ A. The GDPR guards own data whatever the engineering employed for processing that data. It can be technologies neutral and relates to both of those automated and handbook processing, https://www.nathanlabsadvisory.com/blog/tag/security-culture/