The verdict in three sentences
An HR application processes sensitive data (health, disciplinary records, pay), which makes the data protection impact assessment (DPIA) almost mandatory and privacy by design cheaper than retrofitting compliance. For an 800-employee group, expect EUR 8,000 to 20,000 excl. VAT of compliance overhead on the project, plus EUR 300 to 900 per month for an outsourced DPO if you have none in-house. With fines of up to 4% of worldwide turnover, it is one of the most profitable investments in the project.
The compliance budget line by line
Here are 2026 orders of magnitude for a custom internal HR application (employee files, absences, annual reviews, training).
| Item | Content | Indicative cost excl. VAT |
|---|---|---|
| Impact assessment (DPIA) | Data mapping, risks, measures, DPO opinion | EUR 2,500 to 6,000 |
| Encryption | Database encrypted at rest, sensitive fields encrypted in app, TLS 1.3 | EUR 1,500 to 4,000 |
| Access logging | Who viewed which file, kept 6 to 12 months | EUR 1,500 to 4,000 |
| Role-based access | Employee, manager, HR, payroll, executives, scoped by entity | EUR 2,000 to 5,000 |
| Automatic purge and archiving | Scheduled jobs based on retention periods | EUR 1,500 to 3,500 |
| Rights portal (access, correction, export) | One-click export of an employee's data | EUR 1,000 to 2,500 |
| Project total | ≈ EUR 10,000 to 25,000 |
If compliance is in the specification from day one, part of these costs blends into standard development and the net overhead is closer to EUR 8,000 to 20,000. Added afterwards, the same work often costs 1.5 to 2 times more.
Retention periods to code into the application
The storage limitation principle requires deleting or archiving each piece of data when it expires. Here are the most common periods, based on the CNIL HR guidelines and the French Labour Code.
| Data | Active database period | Intermediate archive | Automatic action |
|---|---|---|---|
| Employee file | Contract duration | 5 years after departure | Archive then delete |
| Payslips (employer copy) | Contract duration | 5 years | Archive |
| Rejected applications | 2 years maximum with consent | None | Delete |
| Disciplinary sanctions | 3 years maximum | None | Delete |
| Absence and leave data | Current year + 1 | 5 years (disputes) | Archive |
| Application access logs | 6 months to 1 year | None | Delete |
| Badges and access control | 3 months | None | Delete |
Turn this table into tested technical rules: a nightly purge job, a monthly deletion report and a log proving execution. That evidence is what counts during an audit.
Governance: DPO, records and processors
| Option | 2026 cost | For whom |
|---|---|---|
| Part-time in-house DPO | 25 to 40% of a legal counsel salary | Groups above 2,000 employees |
| Outsourced DPO | EUR 300 to 900 excl. VAT per month | Mid-size firms, 250 to 2,000 employees |
| Records of processing software | EUR 50 to 250 per month | All sizes |
| GDPR addendum with the development provider | Included in contract | Mandatory (Article 28) |
| Annual compliance audit | EUR 2,000 to 5,000 excl. VAT | Recommended |
The application must appear in the records of processing activities with its purposes, data categories, recipients and retention periods. The provider who builds or hosts the tool is a processor: its contract must state data location (EU), security measures and a duty to report a breach within 48 h so you can meet the 72 h deadline towards the regulator.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Sophie, HR director of an 800-employee industrial group near Lille, commissions an HR tool to replace shared spreadsheets. She builds compliance into the specification: DPIA EUR 4,000, encryption and logging EUR 5,500, automatic purge EUR 2,500, rights portal EUR 1,500, i.e. EUR 13,500 excl. VAT. She outsources the DPO at EUR 600 per month, EUR 7,200 a year. Previously her team handled about 15 access requests a year at 6 hours each; automatic export brings that down to 30 minutes, saving 82 HR hours a year, about EUR 3,300 at a EUR 40 loaded hourly cost.
FAQ
Is a DPIA really mandatory for an HR tool?
It is as soon as the processing meets at least two criteria on the CNIL list, for instance sensitive data and vulnerable persons (employees in a subordinate relationship). An 800-employee HR app almost always meets them, and a DPIA costs EUR 2,500 to 6,000.
What is the risk in case of a breach of the rules?
Fines can reach EUR 20 million or 4% of worldwide turnover. In practice, the CNIL has recently issued penalties ranging from tens of thousands to several million euros for excessive employee monitoring.
Can the application be hosted outside the EU?
It is possible with safeguards (standard contractual clauses, Data Privacy Framework), but it makes the DPIA heavier. Hosting in France or the EU often costs the same, EUR 150 to 450 per month for this kind of tool.
Can managers see health data?
No: managers only see absences, without medical reasons. Only authorized HR staff and occupational health see certain information, which justifies a fine-grained rights model at EUR 2,000 to 5,000.
Do employees need to be informed?
Yes, through a privacy notice and consultation of the works council before go-live if the tool can monitor activity. Allow 4 to 6 weeks for this step in the schedule.
Let's scope your project. Share the scope of your HR tool: we will cost development with built-in compliance (EUR 8,000 to 20,000 excl. VAT of overhead depending on scope), purge rules and the DPIA schedule. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
