It's common practice to allow users of your service to get email notifications about interesting events. For example user Joe subscribes to notifications to email address joe@emailprovider.com about new posts from his friends. He expects to receive emails like this:

Hi Joe,

New post from Peter: yada-yada-yada...

But in this email I'm handing over personal data to emailprovider.com. My understanding is that under GDPR my service is the data Controller, and emailprovider.com acts as a data Processor. Does it mean I need to set up a Data Processing Agreement with emailprovider.com before sending out the email?

Browse other questions tagged or ask your own question.