The verdict in three sentences
An HR app that stores appraisal notes, sick leave or disciplinary records processes high-risk data under the GDPR, and German supervisory authorities expect proportionate safeguards. For a Berlin mid-sized company, the security layer usually adds 10,000 to 25,000 EUR excl. VAT to the development budget: encryption, access logging, a DPIA and a penetration test. The application core itself falls under medium complexity on the Kolonell grid, 4,000,000 to 7,000,000 FCFA (6,100 to 10,670 EUR excl. VAT), plus these compliance measures costed item by item.
Regulator expectations by risk level
Not all HR data is equal. An internal directory does not require the same safeguards as an occupational health record. The table below summarises the usual expectations of the German data protection authorities, applied to an HR app.
| HR data type | Risk level | Expected measures | DPIA required |
|---|---|---|---|
| Directory, job title, department | Low | Authentication, role-based access | No |
| Annual review objectives and notes | Moderate | Encryption in transit, access log | Recommended |
| Pay, bonuses, bank details | High | Encryption at rest, two-factor authentication | Yes if large scale |
| Sick leave, medical fitness | Very high | Field-level encryption, restricted named access | Yes |
| Disciplinary records | High | Limited retention, automatic purge | Yes |
| Automated evaluation or scoring | Very high | Employee information, human review | Yes |
As soon as the app combines evaluation and sensitive data for more than a few hundred employees, a data protection impact assessment (DPIA) becomes unavoidable. In Germany, the works council (Betriebsrat) must also be consulted on any tool that can monitor performance.
Item-by-item cost in 2026
Here are 2026 orders of magnitude observed on the Berlin market to secure a custom HR app for 500 to 2,000 employees.
| Security measure | Estimated cost (Berlin market) | Recurring |
|---|---|---|
| Encryption at rest and in transit (TLS 1.3, AES-256, key management) | 2,000 to 5,000 EUR excl. VAT | Key rotation included in maintenance |
| Access logging and alerts | 1,500 to 4,000 EUR excl. VAT | Log storage 10 to 40 EUR per month |
| DPIA (law firm or external DPO) | 2,000 to 6,000 EUR excl. VAT | Review every 3 years |
| Certified sovereign hosting (C5 or ISO 27001, EU region) | 80 to 300 EUR per month | Yes |
| Penetration test before go-live | 4,000 to 9,000 EUR excl. VAT | Recommended yearly |
| Two-factor authentication and Microsoft Entra ID SSO | 1,500 to 3,500 EUR excl. VAT | No |
| Automatic purge by retention period | 800 to 2,000 EUR excl. VAT | No |
Added up, these measures come to 11,800 to 29,500 EUR excl. VAT. Part of it can be built into the initial development if it is in the specification from the start, which costs far less than retrofitting compliance.
What gets decided before the first line of code
Three choices weigh on the budget and on your legal exposure. The first is hosting location: a German or EU host avoids transfers outside the EU and simplifies documentation. The second is access granularity: managers see their teams, HR sees everything except medical data, the occupational physician sees medical data. The third is retention, configured per data category rather than handled manually.
A GDPR fine can reach 4 % of worldwide turnover, and HR data breaches regularly appear among notifications. Investing 15,000 EUR upfront is a reasonable trade-off against that risk.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Illustrative example: Katrin, HR director of a 1,200-employee company in Berlin, launches an app for appraisals and employee files. The application core is priced at 6,500,000 FCFA, about 9,910 EUR excl. VAT. She adds encryption (3,500 EUR), logging (2,500 EUR), an external DPIA (4,000 EUR) and a pentest (6,000 EUR), i.e. 16,000 EUR. Sovereign hosting: 150 EUR per month. First-year budget: about 27,700 EUR excl. VAT. Spread over 1,200 employees, that is 23 EUR per employee, less than a typical HR SaaS licence estimated at 4 to 8 EUR per employee per month.
FAQ
Does a custom HR app require a DPIA?
Yes as soon as it processes health data, disciplinary records or large-scale evaluation. A DPIA by a specialist firm costs 2,000 to 6,000 EUR excl. VAT depending on complexity.
Do I need health-grade hosting for an HR app?
Only if the app stores health data produced in a care context, such as occupational medicine files. Otherwise ISO 27001 certified EU hosting at 80 to 150 EUR per month is enough.
How long should appraisal notes be kept?
Recommended practice is the length of employment, then limited archiving. Disciplinary warnings are usually removed after 2 to 3 years, and automatic purge should reflect this.
Does encryption slow the app down?
With AES-256 and a modern database, the impact stays under 5 % of response time. Field-level encryption of medical data is the only item that needs careful design.
What timeline for a compliant HR app?
Allow 10 to 12 weeks, including 2 for the DPIA and security scoping and 1 for the penetration test and fixes.
Let's scope your project. List the HR data you want to centralise and your headcount: we define the scope, an indicative budget between 4,000,000 and 7,000,000 FCFA for the core plus security measures, and a 10 to 12-week timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
