GDPR compliance cost: what moves the price, and what should never be in it

What does GDPR compliance cost, and where does the money go?

A GDPR programme is priced by what has to be understood, decided and changed in your organisation, which is why two quotations for the "same" work can look nothing alike. The spend falls into five places, and only some of them appear on an invoice.

Most budgets underestimate the second row. Only your people know which spreadsheets hold customer data and which supplier hosts payroll.

The drivers that move the price

Each driver below changes the effort needed to reach a programme you can demonstrate, which is what Article 5(2) and Article 24 ask of a controller.

Volume and spread of processing

The number of processing activities is the single strongest driver. A firm with one customer database and an HR system needs far fewer mapping sessions than a group running marketing, payroll, call recording, CCTV and client data for dozens of customers. Each activity needs a purpose, a lawful basis, a retention decision and a place in the record of processing.

Controller, processor or both

A controller decides purposes and lawful bases, writes notices and answers rights requests. A processor follows instructions, but must support its controllers, keep its own record of processing categories and flow the Article 28 terms down to its sub-processors. Outsourcing and shared services firms are often both at once, and each role brings its own contracts and records.

Suppliers, group companies and transfers

Every supplier that touches personal data needs an agreement with the Article 28(3) terms, and every flow outside the EU and EEA needs an adequacy decision, an appropriate safeguard or a narrow derogation. Cloud platforms, offshore support teams and sister companies in other countries each add a line to the transfer map and a document to negotiate.

High-risk processing

Profiling, large-scale health or biometric data and systematic monitoring bring data protection impact assessments under Article 35, and possibly prior consultation with the supervisory authority under Article 36. The number of DPIAs due is a direct cost line.

Existing maturity

An ISO/IEC 27001 system already supplies much of the Article 32 security evidence, the incident process and the supplier controls. A current data inventory, signed contracts and working request handling reduce the build to refinement.

Jurisdictions and level of support

Adding the UK GDPR, or the Philippine, UAE or Indian data protection laws, adds a jurisdiction layer to one programme rather than a second programme, but each layer still needs its own checks. Finally, Design™, where your team implements with Sterling's guidance, needs less consultant time than Drive™, where Sterling takes on the agreed consulting and documentation work.

What should not be in the price

A GDPR certificate. None exists for the Regulation as such. An offer that bundles a "GDPR certificate" is selling a document no regulator recognises; Article 42(4) is explicit that even an approved seal leaves your own responsibility unchanged. The difference between the GDPR, ISO/IEC 27701 and other frameworks has its own guide, GDPR vs ISO/IEC 27701, ISO/IEC 27001 and SOC 2.

Documents by the page. The Regulation sets no document count. Charging per policy rewards volume, and every unnecessary procedure must then be kept current and followed. The documentation guide sets out what the Regulation actually expects in writing.

Pending law. The European Commission has proposed a lighter record-keeping regime for smaller organisations, but proposals do not change today's obligations. Price the programme against the text in force, and let any adopted change reduce the maintenance effort later.

Hidden costs that surface later

Overruns usually come from work left out of the first estimate.

• IT remediation. Deleting data at the end of its retention period, limiting access by role and finding every record about one person for an access request often need changes to systems that were never designed for them.
• Contract negotiation. Large suppliers often offer their own terms instead of signing yours; reviewing theirs, recording sub-processor approvals and closing gaps takes legal and procurement time across many weeks.
• Legal review. Decisions on legitimate interests, special-category conditions or transfer mechanisms may need your lawyers. Sterling's work is consulting, not legal advice, so that line stays yours.
• Roles by service contract. An outsourced data protection officer or an EU representative is an annual commitment, not a project cost. In the United Kingdom, the data protection fee applies unless you are exempt.
• Getting it wrong. Supervisory authorities can order processing brought into line, limit or ban it, suspend data flows to a third country and impose administrative fines under Article 83. For a business that depends on the processing, an order to stop can cost more than the fine.

How to compare GDPR compliance offers

Put every quotation against the same questions before looking at totals; the order of work behind them is set out in GDPR compliance step by step.

GDPR compliance cost: questions buyers ask