You need one wherever a supplier touches personal information about your customers or employees, and that list is longer than most owners expect. Your email marketing platform, your customer records system, your accounting software if it holds customer details, your booking tool, your payroll provider, and any contractor with access to customer data. Each is processing on your behalf, and the obligation to have terms in place sits with you rather than with them.
In practice this is usually not a negotiation. Established software providers publish a standard agreement, frequently as an addendum you accept within your account settings, and that satisfies the requirement. The work is finding and accepting them rather than drafting anything, and the common failure is simply never having looked, which means a business believes it is compliant while having no agreement with half its suppliers.
Contractors and small suppliers are where the gap usually is. A freelancer with access to your customer list, a bookkeeper, or a virtual assistant handling enquiries is processing personal data and typically has no standard agreement to offer. That is the situation where you need terms in writing, and they can be short: what they may use the data for, that they will not use it otherwise, what security they maintain, and that they delete it when the work ends.
Whether the obligation formally applies depends on which regimes reach your business, and the useful posture is that the underlying practice is worth adopting regardless. Knowing which suppliers hold customer data, and having written terms about what they may do with it, is basic operational hygiene rather than a compliance exercise, and it is the same list you would need if you ever had to notify people about an incident.
This is general information rather than legal advice. The practical step for a first year business is to list every tool and person with access to customer data, accept the published agreement where one exists, and put a short one in place where it does not.