Law and billing
Controller, processor and the DPA
Under the GDPR the customer who decides what to do with personal data is the controller; the host that stores it on their behalf is the processor; the DPA is the contract between them.
The GDPR assigns roles. The controller decides why and how personal data is processed: the business that runs a website or a mailbox. The processor handles the data on the controller's instructions: the hosting provider that stores it. Each has duties; the controller's are broader, the processor's are mostly about security, confidentiality and doing only what it is told.
Article 28 requires a written contract between the two, the data processing agreement (DPA). It sets out what is processed, for how long, the security measures, what happens at the end, and which sub-processors the processor may use. A host's DPA should be published and should list its sub-processors, because every one of them is a company that may touch your data.
For a customer, the practical checks are: is there a DPA, who is on the sub-processor list, where is the data processed, and under which law. A short list and one jurisdiction make the register of processing a short entry.