In The event your application needs your customers to enter their info on their own personal products, You then qualify for SAQ A. The information security authorities, Performing collectively in the European Data Protection Board, must be sure that the data security policies while in the EU are applied in https://www.nathanlabsadvisory.com/blog/nathan/mas-technology-risk-management-in-singapore-ensuring-cyber-hygiene-and-compliance/