can a processor agreement also be agreed orally or by email

Oral or by email is not enough

No, an oral agreement or loose email exchange does not qualify as a data processing agreement. Article 28 of the GDPR requires that arrangements between a data controller and a data processor are set out in a contract or other legal act that is in writing, and writing may also be electronic. A telephone assurance or an oral agreement during a conversation falls outside this: it is not recorded in a way that can be checked afterwards.

An email exchange falls somewhere in between. Isolated emails in which parties mention some arrangements about data processing are usually not a full-fledged data processing agreement in themselves, because the GDPR sets requirements for the content that typically do not appear completely in such an email exchange. A written or electronic document that does fully cover that content — and that has also been exchanged by email and agreed upon — can count as a data processing agreement. So it is not about the medium itself, but about whether all mandatory elements are included and whether it is clear that both parties agree to it. What exactly must be included is described on what must be in a data processor agreement.

Where this follows from Article 28 GDPR

Article 28, paragraph 3 of the GDPR stipulates that processing by a data processor is governed by a contract or other legal act binding the parties, and that this must be recorded in writing, including in electronic form. This requirement applies uniformly throughout the EU in the same way, because the GDPR is a regulation that has direct effect; there is no room for a different national interpretation on this point. Anyone who is unsure whether an existing agreement with a supplier meets this requirement can verify this via the check on whether the software used complies with the GDPR; for background on the consequences of not having such an agreement, there is the page on what happens without a data processing agreement with a supplier. For the official text of the article itself, the source is the GDPR on EUR-Lex, and for guidance from the Dutch supervisory authority, the Autoriteit Persoonsgegevens is the appropriate source.