What belongs in a data processing agreement for SMS?

If you send SMS containing personal data through a provider, that provider is a processor and an agreement should exist. Four points determine whether it is worth anything.

What is processed

Numbers, message content, delivery statuses and possibly replies. That should be listed explicitly, not summarised as "the necessary data".

Where it sits

Servers, backups and logs. Within the EU the answer is simple; outside it you need additional safeguards that you must be able to explain.

Who else can reach it

Sub-processors. A provider buying routes from third parties passes your numbers to those third parties. Ask for the list.

What happens during an incident

Within what time are you notified? You have your own notification deadline, and you will not meet it if your supplier takes days.

What you must arrange yourself

The legal basis for your sending. A processing agreement covers the processing, not your right to send — that stays your responsibility.