This is a general explanation, not legal advice. Under the GDPR a DPA is required whenever a processor handles personal data for a controller. Most software providers offer a standard one, sometimes built into their terms, sometimes as a separate document to sign.
Why it matters
A tool that reads customer email processes a lot of personal data. The DPA is where its promises become obligations: that it uses the data only to provide the service, keeps it confidential, reports a breach, helps you answer customer requests, lists its sub-processors and tells you before adding new ones, and deletes or returns the data at the end.
When comparing tools, the DPA is also where to look for limits on reuse, such as a no-training clause.
An example
Before connecting a drafting tool to the support inbox, a business asks for its DPA, checks where the data is stored and which sub-processors are listed, and files a signed copy with its records.
In ReplyPen: Ask for the DPA at [email protected]. The companies involved are named on where your data goes.