In the past five years, organizations have had to update their data contracting and vendor management strategies to account for the invalidation of the U.S.-E.U. Safe Harbor framework, and then for the GDPR. Now, the CCPA warrants yet another review of vendor contracts. The first article in this series, “Service-Provider Exemption and Corporate Approaches,” analyzed the CCPA’s new definitions and the service provider exemption, and their implications for vendor contracting, and provided examples of how companies have managed updates. The second article, “Non-Third Parties and Key Steps,” contained advice from privacy counsel regarding the non-third-party exemption and the B2B moratorium, and included relevant case studies and key steps for ensuring CCPA-compliant vendor contracts.