A simple brochure website with only a contact form is often handled within a day: a privacy notice, a cookie banner and a brief check of the hosting provider. A web shop with a payment provider, shipping tool, newsletter system and advertising pixels typically takes two to four weeks, especially because you need to check for each tool whether a processor agreement is required and whether it is already in place.
The most common delaying factor is rarely writing the privacy notice itself. That can be done in an hour. The time is spent identifying which tools are running in the background, who manages the processor agreement for each of them, and waiting for a supplier to respond to a question about it.
Where the time really goes
With a new website, you start with an inventory: which third-party services process data from visitors or customers. Think of the hosting provider, an analytics tool, a chat widget, a payment provider, a shipping partner and possibly an advertising network. For each of those parties, the question arises whether a processor agreement has been concluded and whether it matches what the tool actually does.
Next comes the cookie inventory: which cookies are placed, by whom, and whether consent is needed for them. Only when that picture is complete can the privacy notice be factually correct and can the cookie banner display the right categories. Those who skip these steps and write the privacy notice first often have to revise it afterwards. In the knowledge base by topic for each commonly used tool provides the short answer to whether a processor agreement is required, along with the reference in the text of the regulation.
What extends the timeframe in practice
The biggest delay is usually not with you, but with the supplier. Large, well-known SaaS providers typically have a processor agreement ready that you can download yourself or accept digitally. With smaller or specialized suppliers, you sometimes have to ask actively, and it can take days or weeks before you get a response.
A second delay occurs when marketing, IT and the business owner are not at the table at the same time. The marketing department chooses a new tool, IT does not know it has been added, and nobody checks whether a processor agreement comes with it. By the time this becomes apparent, the tool is often already running for months.
A third factor is uncertainty about the division of roles: is a party a processor, or is it a matter of joint responsibility, or does the party process the data for its own purposes. That question is not always answered in five minutes, and in case of doubt it is advisable to ask the supplier yourself how they see their role, or to put the question to a lawyer.
What you can speed up yourself
The fastest route is to do the work in the right order: first map out the tools, then request or check the processor agreements, and only then align the privacy notice and cookie banner with what actually happens. A register that is automatically populated from a library of known tools saves time here, because much of the investigation work is already done for commonly used SaaS services. Once a new tool is added, it is advisable to record it in the records of processing activities instead of postponing that until a review point.
It also helps to determine in advance who within the company is responsible for requesting missing processor agreements. Without a clear owner of that process, an outstanding request to a supplier often remains unresolved.
When it takes longer than expected
For a webshop with many separate components — a separate returns portal, a standalone review system, an external customer service tool — each component counts separately. A new AI chatbot on the website also brings its own question about where visitor input goes and who processes it. When in doubt about whether a new feature requires a more extensive risk assessment, it is wise to have that assessed separately; that falls outside the scope of this article.
The security side of a new website also takes time: a sound assessment of which technical measures are appropriate depends on what the website or webshop actually processes. An overview of what that concerns can be found on the page on data protection and security.
The implementation time is therefore not a fixed number, but the result of how many separate components a website or webshop has and how quickly suppliers respond. Those who estimate this in advance prevent a launch from being delayed because a data processing agreement is missing at the last moment.
Would you like to quickly see where your own website or webshop currently stands? The free quick-scan provides a first indication in a few questions, and the frequently asked questions answer a large part of the individual questions that come up during this process.