Do you sign a Data Processing Agreement (DPA)?

When a vendor processes personal data on behalf of the client, Article 28 of the GDPR requires a legal instrument that governs the processing: this is the so-called DPA. It's not optional, and it must be signed before processing begins. The same applies down the chain to any third-party services involved, which must be listed as sub-processors.