Before bringing an action under section 87-1124, the Attorney General shall notify a controller or processor in writing, not later than the thirtieth day before bringing the action, identifying the specific provisions of the Data Privacy Act the Attorney General alleges have been or are being violated. The Attorney General may not bring an action against the controller or processor if:

(1) Within the thirty-day period, the controller or processor cures the identified violation; and

(2) The controller or processor provides the Attorney General:

(a) A written statement that the controller or processor cured the alleged violation and supportive documentation to show how such violation was cured; and

(b) An express written statement that the controller or processor shall not commit any such violation after the alleged violation has been cured.