GDPR requires requires organizations governed by the regulation to memorialize their data processing activities through a contract pursuant to GDPR Article 28. But, what exactly does the contract need to include and what are some common negotiating points to be aware of when negotiating a data processing agreement?