The verdict in three sentences
As long as your company receives fewer than 20 rights requests a year, a well-kept Excel register and a dedicated mailbox are enough. Beyond that, the one-month legal deadline and searching for data across CRM, HR systems and email make tooling essential: a privacy compliance platform (4,000 to 20,000 EUR a year) or a custom application (18,000 to 35,000 EUR excl. VAT) integrated with your systems. Custom becomes relevant when automating data collection from your internal tools matters more than a library of legal templates.
Market platform or custom application
The DPO or CIO of a 250 to 2,000 employee company in the EU or the UK usually compares three scenarios. Amounts below are 2026 orders of magnitude.
| Criterion | Excel and mailbox | SaaS privacy platform | Custom application |
|---|---|---|---|
| Upfront cost | 0 EUR | 2,000 to 6,000 EUR (configuration) | 18,000 to 35,000 EUR excl. VAT |
| Annual cost | DPO time only | 4,000 to 20,000 EUR | 2,500 to 5,000 EUR (hosting, maintenance) |
| Records of processing (Article 30) | Unversioned file | Templates provided, versioned | Versioned, structured around your entities |
| Request form and identity check | No | Yes | Yes, matched to your customer journeys |
| Automatic extraction from CRM, HR, ERP | No | Standard connectors, often extra | Connectors built for your tools |
| Hosting | Variable | Often EU, sometimes outside your country | Country of your choice, certified host |
| Time to go live | Immediate | 3 to 6 weeks | 10 to 14 weeks |
A market platform wins when the main need is data mapping, DPIAs and legal monitoring. A custom app wins when the hidden cost is data collection: each access request takes 3 to 8 hours of manual searching in business tools that standard connectors do not cover.
What regulatory risk costs
The GDPR and UK GDPR require a response within one month, extendable by two months for complex requests if the person is informed. Administrative fines can reach 20 million EUR or 4% of worldwide turnover. In France, the CNIL also issues simplified penalties capped at 20,000 EUR for common breaches, including failure to answer rights requests; the UK ICO uses reprimands and enforcement notices in similar cases.
| Situation | 2026 exposure (order of magnitude) |
|---|---|
| Late answer to an access request | Complaint, formal notice, simplified penalty up to 20,000 EUR |
| Missing or incomplete records of processing | Article 30 breach, ordinary penalty possible |
| Erasure not propagated across all systems | Recurring complaints, risk of in-depth audit |
| Weak identity verification | Data breach if disclosed to a third party, 72 h notification |
| Data hosted outside the EU without safeguards | Unlawful transfer, fines up to 4% of turnover |
| No proof the request was handled | Burden of proof lies with the controller |
Typical scope of a custom application
| Module | Scope | Budget excl. VAT |
|---|---|---|
| Records of processing | Article 30 entries, processors, retention periods, history | 3,000 to 6,000 EUR |
| Request portal | Public form, choice of right, acknowledgement | 2,500 to 5,000 EUR |
| Identity verification | Email, SMS or ID document check, automatic purge | 2,000 to 4,000 EUR |
| Internal workflow | Assignment, deadlines, reminders, DPO approval | 4,000 to 7,000 EUR |
| CRM, HR, ERP connectors | Data search and export, erasure propagation | 4,500 to 10,000 EUR |
| Dashboard and evidence | Average response time, requests by type, tamper-evident log | 2,000 to 3,000 EUR |
Mini case study
Claire is the DPO of a 1,100 employee retail company in Lyon. She handles 140 requests a year, including 90 access requests that take an average of 5 hours each across the CRM, the loyalty tool and the HR system, i.e. 450 hours. At a loaded hourly cost of 55 EUR, that is 24,750 EUR a year. The custom app costs 28,000 EUR excl. VAT with 3,500 EUR of annual maintenance and cuts handling to 1.5 hours per request thanks to connectors: 135 hours, or 7,425 EUR. Annual saving: 24,750 − 7,425 − 3,500 = 13,825 EUR. Payback in about 2 years, before counting the penalty risk avoided.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Does a small company really need a register?
The Article 30 exemption for organisations under 250 employees does not apply when processing is regular, which is the case for payroll or customer files. In practice almost every company must keep a register.
Can we ask every requester for ID?
Only where there is reasonable doubt about identity. The app can grade verification: a known email is enough in 80% of cases, an ID document for sensitive requests, automatically deleted within 30 days.
Where should the app be hosted?
In the EU or the UK, with a host providing Article 28 compliant contractual guarantees. Certified hosting costs 80 to 400 EUR a month depending on service level.
How long until go-live?
Allow 10 to 14 weeks: 2 weeks of scoping with the DPO and IT, 7 to 10 weeks of development and connectors, then 1 to 2 weeks of acceptance testing.
Does the app also cover UK GDPR?
Yes, rights and deadlines are very close. Configuring a UK entity with its own notices usually costs 1,500 to 3,000 EUR excl. VAT.
Let's scope your project. Send us your annual request volume and your tool list (CRM, HR, ERP): we will price a scope between 18,000 and 35,000 EUR excl. VAT, delivered in 10 to 14 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
