Module 3: After the DPA - ongoing vendor obligations