A data processing agreement (“DPA”) needs to be in place when a data controller engages a data processor. The DPA sets out the relationship between the two parties and the data being processed.