The verdict in three sentences
Making a web application GDPR compliant in Amsterdam costs between EUR 5,000 and EUR 20,000 in 2026, over a 4 to 8 week timeline depending on data volume and sensitivity. The key items are encryption, minimisation, consent management, the records of processing and data processing agreements (DPAs) with EU hosting. A regulator fine can reach 4% of global turnover or EUR 20 million: compliance is a risk-reduction investment, not just a tick-box.
GDPR application checklist and 2026 budget
Compliance breaks down into precise workstreams, each with its own cost and timeline. Here is the typical structure of a compliance project for an existing application.
| Workstream | Content | 2026 budget (EUR) | Timeline |
|---|---|---|---|
| Data mapping | Records, purposes, retention | 1,500 - 4,000 | 1-2 wk |
| Encryption | At rest + in transit (TLS, AES) | 1,000 - 3,500 | 1 wk |
| Consent & banner | CMP, granularity, proof | 800 - 3,000 | 1 wk |
| Data subject rights | Access, erasure, portability | 1,200 - 4,000 | 1-2 wk |
| DPAs & processors | Contracts, EU hosting | 500 - 2,500 | 1 wk |
| Security & logging | Logs, MFA, auto-purge | 1,500 - 5,000 | 1-2 wk |
A full project for a mid-sized application therefore lands around EUR 8,000 to 14,000, excluding outsourced DPO support (often EUR 600 to 1,500/month).
Penalties and stakes: why act fast
The cost of non-compliance far exceeds that of implementation. Here are the 2026 orders of magnitude of the risks incurred.
| Breach | Example | Financial risk | Exposure window |
|---|---|---|---|
| No legal basis | Collection without consent | Up to 4% of turnover | On complaint |
| Unreported breach | Notification > 72 h | Fine + reputation | 72 h required |
| Non-EU hosting | Unframed transfer | Injunction + fine | On audit |
| Rights ignored | Erasure denied | Formal notice | 1 month |
| No records | No register kept | Possible fine | On audit |
Regulators often prefer a formal notice before a fine, but any delay worsens the risk and the cost of emergency remediation.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Camille, DPO of an e-health SME in Amsterdam (40 staff), must bring a client-tracking application handling sensitive data into compliance. She commissions a project at EUR 12,000: mapping, AES-256 encryption, a CMP with consent proof, rights management and migration to an EU host. Additional cost: EUR 1,000/month for an outsourced DPO. In an audit revealing processing without legal basis, the theoretical maximum fine would reach 4% of turnover (EUR 3.2M), i.e. EUR 128,000. Compliance at EUR 12,000 therefore protects against a risk more than 10x larger, before reputational impact.
FAQ
What budget for GDPR compliance of an application? Expect EUR 5,000 to 20,000 depending on data sensitivity and volume, plus optional DPO support at EUR 600-1,500/month. An e-health or financial app sits at the top of the range.
Must hosting be in the EU? Strongly recommended: EU hosting simplifies compliance and avoids the heavy framing of non-EU transfers. For sensitive data it is almost unavoidable.
How long does compliance take? Generally 4 to 8 weeks for an existing application, depending on the number of processing activities and the initial state of documentation.
What is the real exposure? Up to 4% of global turnover or EUR 20M, plus the duty to notify a breach within 72 hours and reputational impact that is hard to quantify.
Is a DPO mandatory? It is mandatory for large-scale processing of sensitive data or systematic monitoring. Otherwise, an outsourced DPO is still recommended to keep compliance robust over time.
Let's scope your project. Tell us the nature of your data, your current hosting and your deadline: we will scope a prioritised, costed GDPR compliance plan. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
