It's common practice to allow users of your service to get email notifications about interesting events. For example user Joe
subscribes to notifications to email address joe@emailprovider.com
about new posts from his friends. He expects to receive emails like this:
Hi Joe,
New post from Peter: yada-yada-yada...
But in this email I'm handing over personal data to emailprovider.com
. My understanding is that under GDPR my service is the data Controller, and emailprovider.com
acts as a data Processor. Does it mean I need to set up a Data Processing Agreement with emailprovider.com
before sending out the email?