Last week California voters passed the California Privacy Rights Act, which effectively replaces the existing California Consumer Privacy Act. CRPA has provisions directly pertaining to vendor management, including specific requirements which must be maintained in vendor contracts.
Here's an article which provides a quick overview of the new law, which goes into effect January 2023 for records collected after January 2022:
https://www.jdsupra.com/legalnews/planning-for-the-california-privacy-48889/?origin=CEG&utm_source=CEG&utm_medium=email&utm_campaign=CustomEmailDigest&utm_term=jds-article&utm_content=article-link