Data processing agreement (DPA)
A contract allocating data-protection duties between a controller and processor, including Article 28 terms where GDPR applies.
In practice
Maintain an approved DPA template, record negotiated deviations, and link each signed agreement to the vendor and processing inventory.
Common confusion
A DPA is not the same as a DPIA: one is a contract; the other is a risk assessment.