DPA (Data Processing Agreement)

A legally binding contract between a data controller and a data processor that specifies how personal data will be handled. DPAs are required under GDPR whenever a SaaS vendor processes personal data on behalf of a customer.