Cure Period
Definition
A window of time (usually 30-60 days) that a business is given to fix a privacy violation after being notified, before enforcement action is taken. Many early state privacy laws included cure periods, but the trend is toward removing them to strengthen enforcement.
Legal Definition
Under the VCDPA (Va. Code 59.1-581): the AG must provide a 30-day cure period before bringing an enforcement action, though this provision sunsetted on January 1, 2025. Iowa's ICDPA includes a permanent 90-day cure period. Tennessee offers a 60-day cure period with affirmative defense provisions.
State Laws Using This Term
Practical Example
A state attorney general notifies a company that its privacy policy does not meet legal requirements. The company has 30 days to update the policy and come into compliance. If it does so within the cure period, no penalty is imposed.
Related Terms
Frequently Asked Questions
Are cure periods permanent?
Not always. Several states have included sunset provisions that eliminate the cure period after a few years. Virginia's cure period sunsetted January 1, 2025. Connecticut's sunsetted January 1, 2025. The trend is toward removing automatic cure periods.