This question already has an answer here:
It's common practice to allow users of your service to get email notifications about interesting events. For example user Joe subscribes to notifications to email address joe@emailprovider.com about new posts from his friends. He expects to receive emails like this:
Hi Joe,
New post from Peter: yada-yada-yada...
But in this email I'm handing over personal data to emailprovider.com. My understanding is that under GDPR my service is the data Controller, and emailprovider.com acts as a data Processor. Does it mean I need to set up a Data Processing Agreement with emailprovider.com before sending out the email?
