The verdict in three sentences
GDPR compliance and EU data residency for a website serving EU users are neither a luxury nor a formality: they are a legal obligation enforced by the CNIL, with very real sanctions. In 2026, full compliance costs 800 to 3,500 EUR and takes 1 to 3 weeks, against a theoretical fine of 4% of revenue. The most often neglected — and most sanctioned — point remains the non-compliant cookie consent banner.
The 12-point compliance checklist
A CNIL audit checks specific elements. Here are the 12 points to audit, with their criticality and the typical cost of compliance.
| # | Compliance point | Criticality | Cost / action |
|---|---|---|---|
| 1 | Cookie banner (refuse = accept) | Critical | 300 - 1,200 EUR |
| 2 | Privacy policy | High | 200 - 600 EUR |
| 3 | Complete legal notices | High | 100 - 300 EUR |
| 4 | Records of processing | High | Internal or 500 EUR |
| 5 | Legal basis for each processing | High | Documentation |
| 6 | Defined retention periods | Medium | Documentation |
| 7 | Forms: explicit consent | High | 150 - 400 EUR |
| 8 | Signed DPA with host | High | Provided by host |
| 9 | Active HTTPS encryption | Critical | Included with hosting |
| 10 | Documented access/erasure rights | Medium | Internal procedure |
| 11 | Framed out-of-EU transfers | High | Audit 800 EUR |
| 12 | Google Fonts/analytics hosted locally | Medium | 150 - 500 EUR |
Point 1 concentrates most of the risk: a banner where refusing is harder than accepting is non-compliant, and it is the most frequent sanction ground.
Costs, timelines and real sanctions
Compliance work varies with the site's starting state. Here are the 2026 ranges for a B2B site and the risk scale.
| Scenario | Scope | Cost | Timeline |
|---|---|---|---|
| Nearly compliant site | Cookie + notices adjustments | 800 - 1,500 EUR | 1 week |
| Partially compliant site | + Register, forms, DPA | 1,500 - 2,500 EUR | 1 - 2 weeks |
| Non-compliant site | Full audit + legal rebuild | 2,500 - 3,500 EUR | 2 - 3 weeks |
| Potential sanction | CNIL administrative fine | Up to 4% of revenue or 20M EUR | — |
The CNIL often favours a formal notice before a fine, but it does financially sanction repeated or serious breaches. Getting compliant upfront costs a fraction of the risk.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Sarah, COO of a 25-person B2B services firm in New York serving EU clients, with 3M EUR of EU revenue, discovers her site uses a non-compliant cookie banner, no records of processing and loads Google Fonts directly. A CNIL audit would theoretically expose the company to a fine capped at 120,000 EUR (4% of revenue). She commissions full compliance for 2,200 EUR, delivered in two weeks: compliant banner, register created, DPA signed with the host, fonts hosted locally. The investment is less than 2% of the maximum financial risk and durably removes the threat.
FAQ
Does the GDPR apply to small B2B sites? Yes: as soon as a site collects personal data (form, cookies, emails), the GDPR applies, whatever the company's size.
Is a cookie banner enough? No: it must let users refuse as easily as accept, with no pre-ticked boxes, and block trackers before consent. Many existing banners are non-compliant.
What is the records of processing? A document listing each data processing activity (purpose, legal basis, duration, recipients). It is mandatory and must be presented during an audit.
What concrete sanctions apply? A fine of up to 4% of global revenue or 20M EUR, often preceded by a formal notice. Cookie breaches are regularly sanctioned.
How long to become compliant? Generally 1 to 3 weeks depending on the starting state. A nearly compliant site needs only a few targeted adjustments.
Let's scope your project. Send us your site URL and its current state: we run the 12-point audit and the compliance work. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
