A Data Processing Agreement (DPA) is required for all companies under the jurisdiction of the GDPR that process personal data, or pass personal data onto third parties for processing.