Cure Period (Texas Data Privacy and Security Act)

Texas gives a business one clean shot at fixing a privacy violation before the attorney general can sue. Tex. Bus. & Com. Code § 541.154 requires the attorney general to notify the person in writing, not later than the 30th day before bringing an action, identifying the specific provisions of the chapter alleged to have been or to be violated.

What curing actually takes

Fixing the problem is only half of it. The attorney general may not bring the action if, within the 30-day period, the person cures the identified violation and provides the attorney general a written statement that the person cured the alleged violation, notified the consumer that the consumer's privacy violation was addressed if the consumer's contact information has been made available to the person, provided supportive documentation to show how the privacy violation was cured, and made changes to internal policies, if necessary, to ensure that no such further violations will occur.

Read that as a checklist, because the statute is written as one. A business that quietly rewrites its privacy notice and says nothing has not cured. The written statement is a condition of the safe harbor and it becomes a document in the attorney general's file, so it should be drafted by counsel rather than by whoever owns the website. The internal-policy element is the one most often skipped, and it is the one that shows whether the fix was structural or cosmetic.

It does not expire

Several states wrote expiration dates into their cure provisions, so the right lapsed after a transition period and enforcement went straight to suit. Texas did not do that. Section 541.154 stands with no sunset, no repeal date, and no limitation to violations occurring in an early window, which makes notice and cure a permanent structural feature of Chapter 541.

That is a genuine advantage for Texas businesses, and it changes how a compliance budget should be shaped. A company with reasonable practices and a team able to move quickly is in a materially better position than one with perfect documentation and a slow decision process, because the 30 days run whether or not general counsel is on vacation.

When the cure fails

Section 541.155 reaches a person who violates the chapter following the cure period described by § 541.154 or who breaches a written statement provided to the attorney general under that section. The civil penalty runs up to $7,500 for each violation. The attorney general may bring an action in the name of the state to recover the penalty, to restrain or enjoin the person from violating the chapter, or both, and may recover reasonable attorney's fees and other reasonable expenses incurred in investigating and bringing the action. Penalties collected are deposited under Tex. Gov't Code § 402.007.

Enforcement authority is exclusive to the attorney general under § 541.151, and § 541.156 provides that the chapter may not be construed as providing a basis for, or being subject to, a private right of action for a violation of the chapter or any other law. Plaintiffs' firms cannot sue on Chapter 541 directly. The realistic private-side exposure is a Deceptive Trade Practices Act theory built on a false statement in a privacy notice, which is a separate statute with its own elements and its own notice requirements.

The investigative side deserves attention before any notice arrives. Section 541.153 gives the attorney general investigative authority, and data protection assessments prepared under § 541.105 are available to the attorney general on request. Businesses often answer a notice with a stack of documents written for an entirely different audience. Write them knowing who eventually reads them.