The company (data controller), the data processor, and any subprocessors must sign the DPA.