GDPR compliance cost and timeline depend on what personal data you hold, how many systems and processors touch it, how risky the processing is, and how much documentation you already have. We give no prices, because they vary too much. Instead, here are the drivers, so you can size your own project.
Note that fines are not the cost of compliance. Article 83 sets maximum fines of up to 10 million euros or 2 percent of worldwide annual turnover for some breaches, and up to 20 million euros or 4 percent for others, whichever is higher. They are ceilings for violations, not a budget line.
Driver 1: how much personal data, and where
The first job is knowing what you hold. The UK ICO's accountability guidance points to Article 30 records of processing, which means documenting your processing activities. Ten systems in one cloud region is a short exercise. A hundred systems across teams, spreadsheets and vendors is a long one. Most timelines are set by discovery, not by writing policies.
Driver 2: risk level of the processing
The ICO notes that data protection impact assessments depend on whether processing is likely to be high risk. Each assessment takes people's time. A product with few high risk uses needs a few. A company running profiling, large scale monitoring or sensitive data needs many, and each needs a careful review.
Driver 3: processors and contracts
The ICO guidance on accountability, which covers UK GDPR, also includes contracts between controllers and processors. Every vendor handling personal data on your behalf needs a review and an agreement that fits. Count your vendors. The cost scales roughly with that number and with how much negotiation each contract needs.
Driver 4: technical and organisational safeguards
Article 83 lists, among the factors regulators weigh, the technical and organisational measures an organization put in place under Articles 25 and 32. Those are data protection by design and security of processing. If your security posture is weak, there is engineering work to do, and that can dominate the budget. This is where software practices come in: inventory of components, patching, secrets handling and access control.
Driver 5: existing documentation and maturity
Organizations that already run an information security program and keep records start from further along. Those that do not start by building the basics.
Driver 6: governance roles
The ICO's accountability topics include data protection officers and data protection by design and default. Whether you need a dedicated role, and what it costs, depends on your size and processing. Ask your legal advisers.
Driver 7: certification or codes, if any
The ICO page mentions certification and codes of conduct as optional ways to demonstrate compliance. Article 83 also lists adherence to approved codes of conduct or certification schemes among the factors in fine decisions. They add effort up front, and some organizations decide the benefit is worth it. They are not mandatory.
Where Safeguard fits
For the engineering part, Safeguard builds an inventory of your software with SBOMs, scans dependencies and checks for secrets, which feeds evidence of security of processing. Its compliance library covers data protection frameworks, and its documentation explains which requirements a scan decides and which need your own evidence. No tool makes you GDPR compliant, and Safeguard does not certify you.
What to do
- Count systems, vendors and high risk processing activities. These three numbers size the project.
- Start the Article 30 records with your most sensitive data.
- List processors and check each has a suitable agreement.
- Review your security basics against the Article 32 expectation of appropriate measures.
- Ask two advisers or vendors for a scoped estimate against your counts, not a generic price.
- Plan for ongoing upkeep, not a one time project.
Quick check
Is GDPR a one time project?
No. Records, risk assessments and vendor reviews need upkeep as systems and processing change.
Does the 4 percent figure apply to every breach?
No. Article 83 sets two tiers, up to 10 million euros or 2 percent for some breaches and up to 20 million euros or 4 percent for others, and authorities weigh many factors.
Sources
- GDPR Article 83: general conditions for imposing administrative fines, fetched 18 October 2026
- ICO: Accountability and governance, fetched 18 October 2026
- Safeguard documentation: Compliance, fetched 18 October 2026
Last reviewed: 18 October 2026.
