I think its important to provide some general information about your setup before we can fully understand what you need to take into account. As Erik has highlighted, you may be using CiviCRM with your own or website hosting or you may have subscribed to an online service which provides you with a running copy of CiviCRM.
The reason its important to understand the distinction is because the agreements which need to be in place will differ in both situations.
If your organisation has arranged the hosting and is technically looking after your CiviCRM installation then your organisation is the data processor. You'll also need to check the hosting agreement to be sure if the data crosses boundaries, what the hosting provider does with the data, any sharing or selling etc.
If you've entered into an agreement for a software as a service implementation of CiviCRM, where you do not have a contract with the hosting provider, you should seek an agreement with the service provider to clarify all of the GDPR specific issues. Pretty much as above, you need to be clear with your supporters what is or isn't happening with their data and how you'll be using it.
The agreement differ because you probably have less control over how your data is shared in a software as a service platform, for instance they may be using services for address cleansing or servers in the USA without your knowledge.
You'll be best served thinking of GDPR in two distinct areas
- Data, where its held, how its handled
- Communications and marketing with your contacts including permission to hold their data and agree to your data/privacy policy
If you split up your compliance into these components it becomes much easier to see where your missing information and what agreements you'll need to have put in place.
Hope that makes some sense!