what happens if I don't have a processor agreement with my supplier

Without a data processor agreement, you do not comply with Article 28 GDPR

If a supplier processes personal data on your behalf and there is no data processor agreement, that in itself is already a breach of the GDPR — irrespective of whether anything else goes wrong with that data. Article 28 GDPR requires that the engagement of a processor is documented in a contract or other legal act; without that documentation, the legal basis for the cooperation is absent, even if the supplier itself handles the data carefully.

This applies for example to software in which customer data, personnel data or invoice data ends up: accounting packages, mailing tools, hosting providers. Anyone unsure whether a particular tool falls under this obligation can check this using how do I know if the software I use complies with the GDPR to establish; and the question of whether this also applies to an accountant comes up again at do I need to conclude a processor agreement with my accountant. The absence of an agreement is usually not something that comes to light of its own accord, until there is a data breach, a complaint from a customer or an inspection — and then it turns out that the arrangements are not in place.

Where this follows from Article 28 GDPR

Article 28 GDPR stipulates that processing by a processor is regulated by a contract that mandatorily documents a number of matters, such as the purpose of processing, the duration, and the obligations of the processor; which matters exactly these are is described under what must be in a data processor agreement. The obligation to have this contract rests both with the controller and with the processor, and applies throughout the EU directly from the regulation; who must ensure compliance differs by country — in the Netherlands it is the Dutch Data Protection Authority, in other member states the supervisory authority of that country. More information about the supervisory authority can be found via the Dutch Data Protection Authority.