The verdict in three sentences
GDPR remediation for a web app costs between 6 000 and 25 000 EUR in 2026, depending on whether you start from scratch or from a structured base. The heavy line items are data mapping, consent management and automating data subject rights (access, erasure, portability). The real calculation is not the cost of compliance but the cost of its absence: a supervisory-authority fine can reach 4% of global annual turnover.
What compliance actually covers
GDPR (and the EAA for accessibility) is not a checkbox but a set of documented and technical obligations. A DPO leading remediation must produce a record of processing activities, secure data flows, and make user rights operational without manual work. Here are the 2026 line items and their remediation order of magnitude.
| GDPR requirement | Expected deliverable | Remediation cost 2026 (EUR) |
|---|---|---|
| Records of processing | Data mapping + processing sheets | 2 000 - 5 000 |
| Consent management (CMP) | Compliant banner + proof log | 1 500 - 4 000 |
| Data subject rights (DSR) | Access/erasure/portability flows | 2 500 - 7 500 |
| Data encryption | TLS + encryption at rest | 1 200 - 3 500 |
| Processor contracts (DPA) | Signed DPAs + security annexes | 1 000 - 3 000 |
| Retention policy | Automated scheduled purge | 1 200 - 3 500 |
| DPIA | Impact assessment for sensitive data | 3 000 - 7 000 |
The financial risk, quantified
Fines are no longer theoretical. Supervisory authorities have scaled up simplified procedures, and the scale remains a deterrent. Comparing remediation cost with exposure clarifies the budget decision immediately.
| Scenario | Cost / exposure 2026 | Timeline |
|---|---|---|
| Full remediation, standard app | 6 000 - 15 000 EUR | 3 - 6 weeks |
| Complex app (multi-flow) | 15 000 - 25 000 EUR | 6 - 10 weeks |
| Simplified-procedure fine | up to 20 000 EUR | immediate |
| Major fine (art. 83) | up to 4% of global turnover | immediate |
| Reputational cost of a breach | uncapped | lasting |
Mini case study
Claire, DPO of a financial-services SME in Nantes (18 M EUR turnover), must bring a client app managing 40 000 accounts into compliance. The audit reveals no consent log and an erasure right handled manually in 3 days per request. Remediation costs 11 500 EUR: compliant CMP, automated DSR flows and scheduled purge. Against a theoretical exposure of 720 000 EUR (4% of turnover), the ROI is a matter of hours of thought. Operational bonus: an erasure request now takes 4 minutes instead of 3 days.
FAQ
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
How long does it take to bring an app into compliance?
Between 3 and 10 weeks depending on complexity. A standard single-flow app takes 3-6 weeks; a multi-source app or one with sensitive data needs a DPIA and rises to 8-10 weeks.
Do we need an external DPO if we are a small team?
Not always, but a shared DPO costs 500 to 1 500 EUR/month in 2026 and secures the process. It is mandatory for large-scale processing of sensitive data.
Is a cookie banner enough to be compliant?
No. The CMP is one link. Without a record of processing, signed DPAs and rights management, an isolated banner offers no protection against a fine.
Is encryption mandatory?
GDPR requires "appropriate" measures. In practice, TLS in transit and encryption at rest are expected, especially for financial or health data. Budget 1 200 to 3 500 EUR for implementation.
Can the compliance cost be spread out?
Yes. Prioritise the major risks first (consent, rights, encryption) then complete (retention, DPIA). A two-sprint plan smooths 15 000 EUR across two quarters.
Let's scope your project. Tell us about your app, the data volume processed and your deadline: we define the remediation scope and an indicative budget. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
