The DPA defines the subject matter, duration, nature and purpose of processing, as well as the types of data and the categories of data subjects. Article 28(3) GDPR lists mandatory terms, including:
processing only on documented instructions
confidentiality of the provider's staff
technical and organisational measures under Article 32
rules for sub-processors
deletion or return of data at the end of the contract
The contract must be in writing, and electronic form is sufficient. With SaaS vendors it is usually a standard agreement that you accept in the admin console. The German data protection conference (DSK) lists cloud computing as a typical case of processing on behalf, while tax advisers or banks usually do not qualify.
Our guide Data processing agreement for SaaS explains how to review one.
Note that a DPA does not shift responsibility. The business that commissions the service remains responsible for the lawfulness of processing and must choose the provider carefully in advance.