Both. If UW is the Controller and the Third Party is the Processor, then a UW Controller-to-Processor DPA (or agreement with equivalent privacy and data protection terms and conditions) is required.
Appears in 2 contracts
Sources: Data Processing Agreement, Data Processing Agreement