um contrato de processador pode ser acordado verbalmente ou por e-mail

Verbal or by email is not enough

No, a verbal agreement or a loose email exchange does not qualify as a data processing agreement. Article 28 of the GDPR stipulates that the arrangements between a controller and a processor must be set out in a contract or other legal act that is in writing, and writing may also be electronic. A telephone commitment or a verbal agreement during a conversation falls outside this: it is not recorded in a way that can be verified afterwards.

An email exchange is somewhere in between. Isolated emails in which parties mention some agreements about data processing are usually not a complete data processing agreement in themselves, because the GDPR sets requirements for the content that typically do not fully appear in such an email exchange. A written or electronic document that does regulate that content completely — and that has also been exchanged by email and mutually agreed — can qualify as a data processing agreement. So it is not about the medium itself, but about the question of whether all mandatory components are included and whether it is established that both parties agree to it. What exactly must be included is described on o que deve conter um contrato de processamento.

Onde isto decorre do artigo 28 RGPD

Article 28(3) of the GDPR stipulates that processing by a processor is governed by a contract or other legal act binding the parties, and that it must be recorded in writing, including in electronic form. This requirement applies uniformly throughout the EU in the same way, because the GDPR is a regulation with direct effect; there is no room for a different national interpretation on this point. Anyone who is uncertain whether an existing agreement with a supplier meets that requirement can test this via the check on whether the software used complies with the GDPR; for background on the consequences of the absence of such an agreement, there is the page on what happens without a data processing agreement with a supplier. For the official text of the article itself, the source is the GDPR on EUR-Lex, and for guidance from the Dutch supervisory authority, the Autoriteit Persoonsgegevens is the appropriate source.