A Data Processing Agreement (DPA) is the contract that GDPR Article 28 requires between a Controller (the customer who decides why and how personal data is processed) and a Processor (the vendor who processes it on the Controller's behalf).
A compliant DPA must include: subject matter and duration of processing, nature and purpose, type of personal data and categories of data subjects, obligations and rights of the Controller, instructions, confidentiality, security measures, sub-processor authorization, audit rights, breach notification, and end-of-term data return/deletion.
Most SaaS vendors publish a standard DPA that customers can sign electronically. Enterprise customers often request modifications (alternative jurisdiction, expanded audit rights, narrower sub-processor lists).