The verdict in three sentences
In 2026, making a custom web application GDPR-compliant costs between 5,000 and 20,000 EUR excl. VAT depending on data sensitivity and the number of processing activities. Expect 3 to 6 weeks for the records of processing, consent, processor DPAs and EU hosting. The privacy by design principle bakes in compliance from the start: two to three times cheaper than retrofitting it later.
The GDPR checklist and cost per requirement
Compliance is not a single document but a set of technical and organisational measures. Here is the 2026 breakdown.
| GDPR requirement | What it involves | 2026 cost (EUR excl. VAT) |
|---|---|---|
| Records of processing | Mapping data and purposes | 1,000 - 3,000 |
| Consent management | Banner, granularity, proof | 1,500 - 4,000 |
| Data-subject rights | Access, rectification, erasure | 1,500 - 4,500 |
| Processor DPAs | Contracts, chain of liability | 800 - 2,000 |
| Encryption + minimisation | Data at rest and in transit | 1,500 - 4,000 |
| EU hosting | EU datacentre, framed transfers | 500 - 2,500 |
| Retention policy | Automatic purge, durations | 1,000 - 2,500 |
The total explains the 5,000-20,000 EUR range, depending on whether the app processes basic or sensitive data (health, finance).
The regulator fines to avoid
Non-compliance is not theoretical. The 2026 orders of magnitude justify the investment.
| Breach | Potential fine | Enforcement frequency |
|---|---|---|
| No legal basis | up to 20M EUR or 4 % of revenue | High on complaints |
| Invalid consent | 10,000 - 300,000 EUR (SME) | Active cookie targeting |
| Unreported breach (72 h) | 50,000 - 500,000 EUR | Systematic post-leak |
| No records of processing | 5,000 - 50,000 EUR | On inspection |
| Unframed non-EU transfer | 20,000 - 200,000 EUR | Rising |
A 12,000 EUR compliance project is marginal against a fine and the associated reputational damage.
Mini case study
Sophie, DPO of an e-health SME in Nantes, launches a patient application handling health data (sensitive data). Retrofitting compliance after launch would have cost around 28,000 EUR plus a suspension risk.
She builds GDPR in from the start: 15,000 EUR excl. VAT for records, granular consent, encryption, certified EU health hosting and a retention policy. Result: a clean regulator audit, a trust argument with client institutions, and 13,000 EUR saved versus a retrofit. Compliance becomes a competitive edge in hospital tenders.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
How does privacy by design change the budget?
Building compliance in from the start costs 5,000 to 20,000 EUR; retrofitting it after launch costs 2 to 3 times more, because architecture and databases often have to be reworked.
Must hosting be in the EU?
Not always, but EU hosting hugely simplifies compliance by avoiding framed international transfers. For health data, a certified host is required.
Who is liable, the publisher or the vendor?
The data controller (you) bears final responsibility, but the vendor is a processor under GDPR, bound by a DPA. The chain of liability must be contractualised.
Do we need a DPO for a small app?
Not systematically, unless large-scale processing of sensitive data or regular monitoring. Many SMEs outsource a part-time DPO for 500 to 2,000 EUR/month.
How long does compliance take?
Expect 3 to 6 weeks for a standard application, in parallel with development if the approach is privacy by design.
Let's scope your project. Specify the type of data processed, user volume and your deadline, and we will define the compliance work. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
