The verdict in three sentences
Bringing a showcase or e-commerce site into GDPR compliance costs between 3,000 and 12,000 EUR (excl. tax) in 2026, with most of the budget going into the CMP (cookie banner), the records of processing and the processor contracts (DPAs). It is not a one-off project but a state to maintain: a new service, new analytics tool or new form triggers a compliance review. The real financial stake isn't the cost of compliance, it's the risk of a regulator fine and lost trust in the event of an audit or breach.
The compliance checklist
Before pricing, you must map what's missing. Here are the blocks every SME site must cover in 2026.
| Item | Mandatory | Common SME status |
|---|---|---|
| Compliant consent banner (CMP) | Yes | Often absent or non-compliant |
| Up-to-date privacy policy | Yes | Generic, not specific |
| Records of processing activities | Yes | Rarely kept |
| Processor contracts (DPAs) | Yes | Missing (analytics, mailing) |
| Complete legal notices | Yes | Incomplete |
| Defined retention periods | Yes | Undocumented |
| Access/erasure request procedure | Yes | Non-existent |
| Encryption (HTTPS, passwords) | Yes | Often OK |
Cost per batch
Rather than an opaque flat fee, breaking the work into batches lets you prioritise and phase it. Here are 2026 orders of magnitude.
| Batch | Content | 2026 cost (EUR excl. tax) |
|---|---|---|
| CMP + cookie management | Install, configure, categorise | 800 - 2,500 |
| Legal texts | Privacy policy, notices, terms | 900 - 3,000 |
| Records + mapping | Inventory of processing and purposes | 1,000 - 2,500 |
| Processor contracts (DPAs) | Identify and align | 500 - 1,500 |
| Audit + action plan | Assessment and recommendations | 1,200 - 3,500 |
| External DPO support | Annual retainer | 2,000 - 6,000/year |
Fine risk and sovereign hosting
Data-protection regulators impose real fines, including on SMEs, often after a complaint or a non-compliant cookie. Hosting choice also affects data sovereignty.
| Topic | 2026 order of magnitude |
|---|---|
| SME regulator fine (common case) | 5,000 - 50,000 EUR |
| Maximum GDPR fine | 20M EUR or 4% of global revenue |
| Formal notice (no fine) | 0 EUR but correction deadline |
| EU hosting (OVH, Scaleway) showcase | 10 - 60 EUR/month |
| Equivalent non-EU hosting | Similar but transfer risk |
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Hosting in the EU (OVH, Scaleway) simplifies the question of data transfers outside the EU and reassures clients and partners. For sensitive data, a certified host strengthens your position.
Mini case study
Sophie, director of a B2B services SME in Lyon (18 staff), receives a client complaint about a form with no consent notice. She commissions compliance in three batches: CMP (1,400 EUR), legal texts (1,800 EUR), records + DPAs (2,200 EUR), i.e. 5,400 EUR excl. tax. She adds external DPO support at 3,000 EUR/year. Facing a potential regulator fine of 20,000 EUR and reputational risk with her large accounts, the investment pays off on the first tender where GDPR compliance is required in the specifications.
FAQ
Can you still use Google Analytics? Yes, under conditions: prior consent via the CMP, a configuration limiting transfers, or switching to a European analytics tool (Matomo, Plausible) that simplifies compliance. Budget 300 to 1,200 EUR for migration.
Is a DPO mandatory? Not for every SME. It is mandatory for large-scale processing of sensitive data or systematic monitoring. A shared external DPO (2,000-6,000 EUR/year) is enough for most SMEs seeking protection.
Is a cookie banner enough? No. Consent must be free, specific and revocable, and cookies must only fire after acceptance. A purely decorative banner that drops cookies before the click is precisely the most common ground for a fine.
How long does compliance take? For a standard showcase site, 2 to 4 weeks. For an e-commerce site with many processing activities (payment, delivery, marketing), allow 4 to 8 weeks and a budget toward the top of the range.
Is compliance permanent? No. Every new tool, form or service requires a review. Plan an annual review (500-1,500 EUR) or an external DPO retainer to maintain compliance over time.
Let's scope your project. Tell us the site type (showcase, e-commerce), the tools used and your deadlines, and we'll frame compliance in batches with risk prioritisation. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
