A privacy notice itself costs nothing in its basic form. The GDPR prescribes what must be included, and with a free template or generator you get a long way: who you are, which data you process, why, how long you retain it and who someone can contact with questions. Only when you hire someone to tailor the text, have it reviewed or keep it aligned with your specific situation does a bill arise. What determines that bill is not the length of the text but the amount of work needed to accurately describe your practice.
Three things drive the price if you do choose custom work: the number of processing activities your business carries out, the sensitivity of the data, and whether data ends up outside the EU. A sole trader with a contact form and an accounting package has a simpler story than a web shop with customer profiles, marketing tools and a payment provider based in the United States. The more processing activities, the more time it takes to describe them correctly — and time is almost always the cost factor in legal work.
Where the amount comes from
A privacy notice is not a standalone document but the external expression of what should already exist internally: which systems you use, for what purpose, and how long you retain data. If that overview doesn't yet exist, you're not paying for the text itself but for the investigative work around it. Businesses that already maintain a record of processing activities have largely done that work and can derive the notice directly from it. This is also why a privacy notice rarely stands alone: it is the outward translation of something that must already be correct internally. Read more about this in the knowledge base on building a record of processing activities.
What further determines the price
Within custom work, it matters whether it's a one-off text or something that evolves whenever you acquire a new tool or start processing a new type of data. A web shop that adds a chatbot next year or switches to a different marketing platform will need to have the notice reviewed again. Some providers therefore charge not for the text but for maintaining it. The sector also plays a role: those processing health data, biometric data or data on criminal records fall under a stricter regime within the GDPR, and that requires more precise wording than an average service provider needs.
Free and paid side by side
It's good to keep clear what remains free and what doesn't. The substantive knowledge — what a privacy notice should contain and where that appears in the law — is and remains freely accessible, even without an account. What costs is the system around it: maintaining your record of processing activities, automatically updating the notice as you enter data into it, and monitoring data processing agreements with the tools you use. On the subscriptions page you'll find what applies to gdpria.eu; the free generator itself remains unchanged and available.
When custom work is actually wise
A template suffices for many businesses, but there are situations where it's advisable to have a lawyer review it: when transferring data internationally, when processing sensitive categories, or when a customer or insurer explicitly requests an explanation during a procurement process. In those cases, the cost of a review usually outweighs the time you'd spend working out the correct wording yourself. The Dutch Data Protection Authority publishes guidelines indicating what supervisory authorities focus on; those sources are cited for each topic in the knowledge base, so you can check where a statement comes from yourself.
The privacy notice does not stand alone
A text that is correct does not yet prove that you actually do what it says. Supervisory authorities and, in practice, also customers and insurers increasingly look at the evidence behind it: is there a record, are there data processing agreements with the tools you mention, and is there a process for when a data subject requests access. How these elements relate to each other, and where each piece of information comes from, you can read about the page that explains how the system is structured.
Do you want to know first where your business stands exactly before you spend money on customized solutions? The free quick scan gives you an indication in a few questions, without having to register. For specific concerns about your own text, a lawyer or the Dutch Data Protection Authority remains the appropriate point of contact.