If Your application demands your shoppers to enter their information on their particular devices, Then you really qualify for SAQ A. The data defense authorities, Doing the job with each other in the European Facts Defense Board, should really ensure that the data safety procedures from the EU are applied https://www.nathanlabsadvisory.com/nist-800-171.html