The verdict in three sentences
GDPR compliance for a website is not a luxury: a simple contact form processes personal data and exposes you. Bringing a site into compliance costs EUR 800-3,000 in 2026, against fines that can reach 4% of turnover or EUR 20M. The real risk is not the maximum fine but the formal notice from the supervisory authority, increasingly common on cookies and consent.
The costed compliance checklist
Each item has a cost and a priority. The consent banner and legal notices are the first things regulators check in 2026.
| Element | Mandatory | Indicative 2026 cost | Risk if missing |
|---|---|---|---|
| Compliant cookie consent banner | yes | EUR 400-1,200 | priority regulator check |
| Legal notice + privacy policy | yes | EUR 200-600 | formal notice |
| Record of processing activities | yes | EUR 300-800 | documentary non-compliance |
| Forms with explicit consent | yes | EUR 150-500 | unlawful collection |
| Hosting / data in the EU | recommended | included at EUR 30/mo | non-EU transfer risk |
| HTTPS encryption | yes | included | data exposed |
| External DPO (if required) | activity-dependent | EUR 150-500/mo | no accountable owner |
Fines: the scale to know
Regulators calibrate their sanctions. In 2026, most SME cases end with a formal notice, but repeated breaches are fined financially.
| Situation | 2026 consequence | Order of magnitude |
|---|---|---|
| First formal notice | fix within a deadline | EUR 0 if corrected |
| Persistent cookie breach | fine | EUR 5,000-90,000 (SME) |
| Collection without legal basis | fine | up to 4% of annual turnover |
| Unreported data breach | fine + notification | EUR 10,000-150,000 |
| Individual complaint | regulator investigation | variable |
Mini case study
Marc, director of a construction SME in Berlin (turnover EUR 2.4M), receives a complaint after emailing a newsletter to contacts collected without clear consent. The regulator opens an inquiry. His site has neither a compliant banner, nor a record of processing, nor an up-to-date privacy policy. He costs emergency compliance: banner EUR 900, notices and policy EUR 500, record EUR 600, form rework EUR 400, i.e. EUR 2,400. Against a theoretical fine of up to 4% of EUR 2.4M (EUR 96,000), the investment is obvious. He fixes it within 3 weeks and closes the case with a simple compliance action, no fine.
FAQ
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Does GDPR apply to a simple brochure website?
Yes, as soon as it collects any personal data: contact form, newsletter, analytics cookies, IP address. In 2026, no professional site with a form escapes GDPR. The good news: bringing a brochure site into compliance remains affordable, EUR 800-3,000.
Is a cookie banner enough to be compliant?
No, it is one piece among several. You also need legal notices, a privacy policy, a record of processing and forms with explicit consent. The banner is simply the most visible element and the one regulators check most.
What is the real risk for an SME?
Rarely the maximum fine, more often a formal notice to fix within a deadline. But a persistent cookie breach can cost an SME EUR 5,000-90,000 in 2026. The cost of compliance is negligible against that risk.
Do I need a DPO for a brochure website?
Not always. A DPO is mandatory for certain activities (large-scale processing, sensitive data). For a typical SME, an internal contact plus occasional support is often enough; an external DPO costs EUR 150-500/month if required.
Is hosting outside the EU forbidden?
Not forbidden but risky: non-EU transfers require strict legal safeguards. In 2026, hosting in the EU remains the simplest way to avoid any debate over data transfers. Cost: included in hosting at EUR 30/month.
Let's scope your project. Tell us your forms, your tools (analytics, newsletter) and whether you have received a complaint, and we will audit your site and cost the compliance work. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
