Both the data controller and the data processor need to sign a DPA. The data controller is the entity that determines the purposes and means of processing personal data, while the data processor processes the data on behalf of the controller. Any organization that outsources data processing activities to a third party should have a DPA in place.