data processing agreement
termprivacygovernance & risk
The contract binding a processor to the controller's instructions: security measures, sub-processors, breach duties, and deletion at the end.
The document vendor security reviews orbit around; GDPR Article 28 dictates its skeleton.