The verdict in three sentences
GDPR compliance for a healthcare web app adds 15 to 25% to the project budget in Dublin in 2026, mainly for encryption, logging, consent management and data minimisation. Health data are special category data whose unlawful processing can cost up to 20 million EUR in fines. Mandatory deliverables: a records of processing register, a DPIA (data protection impact assessment) and hosting suitable for health data.
What compliance adds to the budget
Compliance is not a cosmetic layer: it touches architecture, storage, authentication and processes. Here are the line items and their indicative 2026 cost.
| Compliance workstream | Description | Extra cost 2026 (EUR) |
|---|---|---|
| Encryption at rest and in transit | TLS, database + sensitive field encryption | 2,000 - 5,000 |
| Logging and traceability | Access logs on health data | 2,500 - 6,000 |
| Consent management | Capture, proof, withdrawal | 1,500 - 4,000 |
| Minimisation and retention periods | Automated purge, anonymisation | 2,000 - 5,000 |
| DPIA (impact assessment) | Formal risk study | 3,000 - 8,000 |
| Records register + documentation | Legal documentation | 1,500 - 4,000 |
| Rights handling (access, erasure) | Portal or procedure | 2,000 - 6,000 |
In total, on an 80,000 EUR project, compliance often represents 12,000 to 40,000 EUR, consistent with the 15 to 25% range.
Obligations specific to health data
Health data impose stricter rules than ordinary personal data. Here are the checkpoints.
| Obligation | 2026 requirement | Consequence if missing |
|---|---|---|
| Legal basis for processing | Explicit consent or care mission | Unlawful processing |
| Health data hosting | Suitable, certified host | Major non-compliance |
| Retention period | Defined, justified, purged | Possible fine |
| DPIA | Mandatory for large-scale sensitive data | Article 35 breach |
| Encryption | At rest and in transit | Aggravating factor in a breach |
| Access logging | Who read what, when | Cannot prove control |
The fine ceiling for the most serious breaches reaches 20 MEUR or 4% of worldwide revenue, whichever is higher. For a health software vendor, the stake is also contractual: client institutions demand proof of compliance before signing.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Dr. Murphy runs a radiology practice in Dublin developing a patient records app. The initial project is quoted at 70,000 EUR. Adding compliance (record encryption, logging, DPIA, consent and rights management) represents about 16,000 EUR, or 23% of the budget. In return, the app can be offered to other practices without legal blockers, and the risk of a seven-figure fine is removed. Compliance becomes a sales argument: institutional clients only sign with this guarantee.
FAQ
Why do health data cost more to process? They are special category data under GDPR: they require a reinforced legal basis, suitable hosting, a DPIA, encryption and logging. Each of these requirements adds development and documentation.
What is a DPIA and when is it mandatory? The data protection impact assessment is a formal risk study, mandatory for large-scale processing of sensitive data. Budget 3,000 to 8,000 EUR; it must be done before going to production.
How long to make an app compliant? On an ongoing project, plan 4 to 8 weeks of dedicated work depending on existing maturity. Built in from design (privacy by design), compliance costs less than bolting it on afterwards.
What fine applies for a breach? The most serious breaches can reach 20 MEUR or 4% of worldwide revenue. Beyond the fine, a health data leak triggers loss of trust and immediate contract breaks.
Is compliance a cost or an investment? Both: it is a legal obligation, but also a commercial differentiator. Healthcare institutions require proof of compliance before contracting, so a compliant app sells better and at a higher price.
Let's scope your project. Describe your healthcare app (data volume, type of processing, deadline): we'll price the compliance work, often 15 to 25% of budget, with DPIA and register. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
