A DPA is the contract required under GDPR Article 28 between a data controller and a processor, defining how the processor may handle personal data on the controller's behalf.
If you use a SaaS tool to hold client data, you are typically the controller and the vendor is the processor — and you need a DPA in place, plus visibility of the vendor's own sub-processors.