To be GDPR compliant, you need to offer a DPA, either within your terms & conditions, maybe your privacy policy or individualy for signing by the client.
Is a DPA currently available?

See: https://gdpr.eu/what-is-data-processing-agreement/