In case your application involves your customers to enter their info on their own products, then you qualify for SAQ A. The GDPR guards private facts whatever the technological know-how used for processing that facts. It truly is technological know-how neutral and applies to the two automated and guide processing, https://www.nathanlabsadvisory.com/blog/tag/security-culture/