Data protection and accessibility for a management consultancy website in Dublin: what to require (2026)

The verdict in three sentences

A Dublin management consultancy should require from its web provider a written privacy setup (privacy notice, real cookie choice, minimal forms with retention rules, a processor agreement) and a documented WCAG 2.1 or 2.2 AA accessibility level, checked before launch. These requirements fit inside Kolonell's fixed grid of €2,700, €4,500 or €8,200, while typical Dublin agency quotes for a comparable rebuild sit around €15,000 to €40,000. If your firm bids for public sector work, accessibility is no longer a nice extra: buyers increasingly ask for evidence.

Why does a consultancy website carry real data protection exposure?

Consultancies around the Docklands, St Stephen's Green or Ballsbridge rarely think of their site as a data system, yet it often is one. A typical 10 to 80 person firm in strategy, operations, digital or public sector consulting collects personal data through at least four channels: contact and proposal request forms, event or webinar sign-ups, newsletter subscriptions and, very often, a careers page that receives CVs. Add analytics tags, an embedded booking tool and a chat widget, and the site processes data for half a dozen purposes.

In Ireland, this falls under the GDPR and the Data Protection Act 2018, with the Data Protection Commission (DPC) as supervisory authority. Cookies and similar trackers are also covered by the Irish ePrivacy rules, and the DPC has published guidance on cookie consent. In general terms: non-essential cookies need prior consent, rejecting should be as easy as accepting, and pre-ticked boxes do not count as consent. This is not legal advice; your data protection lead or solicitor should validate the final setup.

What should the contract with the web provider include?

Treat the web provider as a processor whenever it hosts or can access form data. Require a written processor agreement covering the subject and duration of processing, security measures, sub-processors (hosting, email delivery, form tools), assistance with data subject requests and a breach notification commitment, so your firm can meet its own obligations to the DPC. Ask where data and backups are stored, who has admin access, and how accounts are removed at the end of the contract.

On accessibility, ask for a target level in writing (WCAG 2.1 AA as the floor, 2.2 AA preferred), an accessibility statement published at launch and an audit of the main templates before go-live. The European Accessibility Act has applied to certain products and services since June 2025; whether it covers a consultancy's own marketing site depends on the services offered, so check the scope with your adviser. For public sector tenders, contracting bodies themselves follow the EU web accessibility rules for public sector websites, and they often expect suppliers to demonstrate the same standard.

What does it cost to get this right in Dublin in 2026?

The ranges below are a 2026 ballpark based on typical Dublin agency quotes and public agency rate pages. They are indicative only.

Kolonell tiers include a project manager reachable in Irish business hours, native English or French copywriting, delivery in 3 to 4 weeks once content is ready and 3 months of support. A candidate portal, CRM integration or proposal workflow stays on quote. The full offer is described on our international offer page.

Which checklist should you use before launch?

Mini case study

Illustrative example: Aoife Brennan is operations director of a 35-person consultancy in Ballsbridge that bids for public sector framework agreements. Her current site uses a consent banner without a reject button and a CV form that stores files indefinitely. She budgets the Growth tier at €4,500 and a third-party accessibility audit at €2,500, so €7,000 in total. If accessibility evidence helps the firm stay eligible for a single framework lot worth €60,000 a year in fees, the investment represents about 12 % of one year's revenue from that lot, before counting any reduction in data protection exposure.

FAQ

Does our consultancy need a cookie banner if we only use analytics?

Analytics cookies are generally non-essential, so prior consent is usually required. Rejecting must take 1 click, the same as accepting.

How long can we keep CVs received through the careers page?

There is no single fixed period; set one that matches your recruitment purpose, often 6 to 12 months, state it in the notice and delete on schedule. Confirm the period with your data protection lead.

Is WCAG 2.1 AA enough?

WCAG 2.1 AA remains the common reference in EU public sector rules; 2.2 AA adds 9 success criteria and is a sensible target for a new build.

Does the European Accessibility Act apply to our website?

It has applied to certain products and services since June 2025, but its scope for a consultancy's marketing site depends on what the site offers. Check with your adviser before assuming either way.

Are privacy and accessibility included in Kolonell's price?

Consent setup, minimal forms and an AA-oriented build are part of the €2,700 to €8,200 tiers; a third-party audit and portals are separate, the latter on quote.

Let's scope your project. Tell us your forms, tools, languages and any tender requirements, and we will return a fixed EUR budget and a 3 to 4 week plan. See the international offer or request a free quote: detailed reply within 48 hours.