Data Processing Agreement (DPA)
A contract required by GDPR between a controller and processor setting out how personal data will be handled.
A Data Processing Agreement (GDPR Article 28) is the written contract between a data controller and its processors (and sub-processors). It must specify the subject, duration, nature and purpose of processing, type of personal data, data subject categories, and controller rights. SaaS vendors ship a standard DPA customers can sign online.