Should your application demands your clients to enter their information on their own individual gadgets, then you qualify for SAQ A. Use robust cryptography when transmitting cardholder info throughout open up, public networks. Both of these specifications be sure that you defend knowledge both of those at rest As well https://www.nathanlabsadvisory.com/blog/tag/gdpr-compliance/