The verdict in three sentences
Serious GDPR compliance for a web application costs between EUR 11,000 and EUR 30,000 as a one-off in 2026, plus an outsourced DPO (EUR 400-1,200/month) and an annual audit (EUR 4,000-9,000). The heaviest item is not legal but technical remediation: consent, encryption, automated purge and access logging. For health or payment data, add 30 to 50 % and a 4-to-8-week timeline.
What compliance really costs, line by line
GDPR compliance is not a single line: it is a sum of legal, technical and organisational workstreams. Here is the 2026 order of magnitude for a B2B web application handling customer data in London.
| Item | 2026 range (EUR) | Indicative timeline |
|---|---|---|
| Records of processing + data mapping | 3,000 - 7,000 | 1 - 2 weeks |
| Consent, banner, preference management | 1,500 - 4,000 | 3 - 6 days |
| Encryption at rest and in transit | 2,000 - 6,000 | 1 week |
| Automated purge + retention periods | 1,500 - 5,000 | 4 - 8 days |
| Access and export logging | 2,000 - 5,000 | 1 week |
| Privacy policy + notices + DPA | 1,000 - 3,000 | 3 - 5 days |
| Data subject rights procedure | 1,500 - 4,000 | 4 - 7 days |
On an average project, the technical + legal total lands between EUR 11,000 and EUR 30,000. Health data or payment data (PCI-DSS) push the upper bound higher.
The recurring cost teams forget to budget
Compliance is a permanent state, not a project. Three items recur every year and belong in your operating budget.
| Recurring item | 2026 cost | Frequency |
|---|---|---|
| Outsourced DPO | EUR 400 - 1,200/month | Monthly |
| Annual compliance audit | EUR 4,000 - 9,000 | Yearly |
| Records + policy updates | EUR 800 - 2,500 | Half-yearly |
| Team training (2 sessions) | EUR 1,200 - 3,000 | Yearly |
| Restore + purge testing | EUR 1,000 - 2,500 | Yearly |
A shared outsourced DPO remains 5 to 8 times cheaper than an internal DPO (EUR 55,000-75,000/year fully loaded) and covers most SMEs.
Mini case study
Claire, CFO of a 40-employee industrial SME in London, must respond to an enterprise tender that requires proof of GDPR compliance for her customer-tracking application. Breakdown: mapping and records EUR 5,000, technical remediation EUR 14,000, policies and procedures EUR 3,000, i.e. EUR 22,000 one-off. She adds an outsourced DPO at EUR 600/month (EUR 7,200/year) and an annual audit at EUR 6,000. The target account is worth EUR 180,000/year: compliance is 12 % of the first year then 7 % recurring, an entry ticket quickly recouped.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
How long does GDPR compliance take?
Expect 4 to 8 weeks for a standard application, more if you handle health or payment data. Records and mapping take the first two weeks, technical remediation the rest.
Internal or outsourced DPO?
For an SME, an outsourced DPO (EUR 400-1,200/month) covers 90 % of needs and costs 5 to 8 times less than an internal role loaded at EUR 55,000-75,000/year. An internal DPO makes sense above 250 employees or for large-scale processing.
What is the real financial risk of non-compliance?
Fines can reach 4 % of global turnover, but the most common risk is commercial: losing an enterprise tender that requires proof of compliance. A EUR 6,000 audit protects a six-figure contract.
Is compliance a one-off project?
No. It is a permanent state requiring an annual audit (EUR 4,000-9,000), records updates and regular testing. Budget it as operating cost, not just capex.
Do we rebuild everything if the app evolves?
No, but each new processing activity (a new data-collecting feature) must be added to the records and assessed. Plan a half-yearly review at EUR 800-2,500.
Let's scope your project. Tell us about your application, the data types you handle and your audit or tender deadline: we will scope a tailored perimeter and indicative budget. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
