This question already has an answer here:
It's common practice to allow users of your service to get email notifications about interesting events. For example user
Joe subscribes to notifications to email address
firstname.lastname@example.org about new posts from his friends. He expects to receive emails like this:
New post from Peter: yada-yada-yada...
But in this email I'm handing over personal data to
emailprovider.com. My understanding is that under GDPR my service is the data Controller, and
emailprovider.com acts as a data Processor. Does it mean I need to set up a Data Processing Agreement with
emailprovider.com before sending out the email?