If your application requires your clients to enter their information on their own personal equipment, Then you certainly qualify for SAQ A. Significant-quantity users will want to protected the services of a QSA who is registered to work in areas in which you are operating. Direct API SAQ D Once https://www.nathanlabsadvisory.com/iso-27701-privacy-information-management-system-pims.html