GDPR is the European regulation that sets the rules for handling personal data, while a DPA is a contract between two parties that puts those rules into practice for a specific relationship. In other words, GDPR is the law and the DPA is one of the documents that helps you comply with it. GDPR requires a DPA whenever a processor handles personal data on a controller’s behalf.
