The verdict in three sentences
Bringing a custom web app up to a security + GDPR standard costs, in 2026, between 9,000 and 21,000 EUR one-off, plus compliant hosting. The two structural line items are the pentest (4,000-12,000 EUR) and the encryption + SSO/MFA base (5,000-9,000 EUR). Against a regulator fine of up to 4 % of turnover or a business shutdown, this budget is insurance, not a cost.
The security + compliance budget in 2026
A leader handling sensitive data (health, HR, financial) must separate what is mandatory (non-compliance = fault) from what is recommended (best practice that lowers risk).
| Measure | 2026 cost | Status | Timeline |
|---|---|---|---|
| GDPR register + processor DPAs | 1,500 - 3,500 EUR | Mandatory | 1 wk |
| Encryption at rest + in transit | included in base | Mandatory | - |
| SSO + MFA | 5,000 - 9,000 EUR | Strongly advised | 2 wks |
| Pentest (intrusion audit) | 4,000 - 12,000 EUR | Advised | 2 - 3 wks |
| Standard EU hosting | 60 - 200 EUR/mo | Mandatory (EU) | - |
| HDS hosting (health data) | 150 - 500 EUR/mo | Mandatory if health | - |
| Logging + alerting | 1,000 - 2,500 EUR | Advised | 1 wk |
The processing register and processor DPAs are the legal minimum: their absence is the first thing a regulator flags in an audit.
What a breach really costs
The compliance budget must be judged against the cost of an incident. An uncontrolled data breach compounds fines, mandatory 72-hour notification, lost trust and downtime.
| Scenario | Estimated financial impact | Order of magnitude |
|---|---|---|
| Regulator fine (serious breach) | up to 4 % of annual turnover | 10,000 - 500,000+ EUR |
| Customer data leak | notification + remediation | 15,000 - 80,000 EUR |
| Ransomware + downtime | 3 to 15 days off | 20,000 - 200,000 EUR |
| Lost contract / reputation | B2B customer churn | variable, often > technical cost |
These are 2026 order-of-magnitude estimates: they almost always exceed the initial compliance budget.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Sophie, director of a teleconsultation practice in Bordeaux, hosts health data. She budgets: HDS hosting 380 EUR/month, SSO/MFA 7,000 EUR, pentest 8,000 EUR, register + DPA 2,500 EUR. Initial investment 17,500 EUR + 4,560 EUR/year hosting. The pentest surfaces 2 critical flaws fixed before go-live. Against a potential six-figure fine and the non-negotiable HDS requirement, the return is immediate: without HDS she simply could not operate legally.
FAQ
Is HDS hosting really mandatory? Yes, as soon as you host personal health data on behalf of third parties. Budget 150-500 EUR/month with an HDS-certified host, versus 60-200 EUR for standard EU hosting.
How often should we pentest? A full pentest at go-live (4,000-12,000 EUR), then a targeted pentest after each major release. Many regulated sectors require an annual cadence.
Is SSO/MFA essential? Not strictly mandatory, but it is the best risk/cost measure: it blocks most fraudulent access from stolen passwords.
How long is the audit? Budget 2-3 weeks for a pentest and its report, plus remediation time for the flaws found.
What's the risk without a GDPR register? It is the first item checked in a regulator audit. Its absence is a formal fault that aggravates any sanction, even without a data leak.
Let's scope your project. Tell us the data type (health, HR, financial), user count and your sector: we price the tailored security + GDPR base. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
