In The event your application demands your clients to enter their info on their own personal devices, Then you really qualify for SAQ A. To make sure that this laws is used constantly, countrywide and European knowledge security authorities and bodies are recognized. The PCI SSC has outlined 12 specifications https://www.nathanlabsadvisory.com/blog/nathan/get-certified-in-data-privacy-compliance-in-saudi-arabia-secure-your-operations/