What does it cost to make a new website or web shop GDPR-compliant?
There is no fixed amount to name, and anyone who does name one is selling you a figure that does not match your situation. The costs of a GDPR-compliant website or web shop consist of a few separate parts: a privacy statement, cookie settings, data processing agreements with the tools you connect, and sometimes an update to your processing activities register. Each part can work out free, cheap, or expensive, depending on how much you do yourself and how much data your site processes.
What mainly determines the amount is the number of SaaS tools connected to your website or web shop. A simple brochure site with a contact form requires little. A web shop with a payment provider, a shipping partner, a customer service tool, a mailing list and an advertising pixel requires its own assessment for each of those connections: who is the processor, is there a data processing agreement in place, and what data is going exactly where.
Where the amount comes from
The first cost item is the privacy statement itself: a text that explains what data you collect, why, and how long you keep it. You can have that drafted by a copywriting agency or lawyer, or use a generator that builds the text from the elements that apply to your situation. At gdpria.eu that generator is free and available without an account; the text is a starting point, not a final product you do not need to look at again.
The second item is the cookie notice and the settings behind it: which cookies are placed only after consent, and which fall outside that. That is usually a matter of time rather than money — someone has to go through the tools running on the site and adjust the settings accordingly.
The third and often largest item is the data processing agreements. Every supplier who processes personal data on your behalf — the hosting provider, the payment provider, the mail tool, the CRM — should in principle have a data processing agreement in place. Large suppliers often provide these ready-made; with smaller suppliers you have to ask for them yourself. Reviewing those agreements takes time, and if you have doubts about a clause, legal advice is the right way. A fixed library that already indicates for each known tool which clauses usually come up saves research work; search the knowledge base by topic shows what free information is available there.
What else determines the costs
Whether you need a data protection impact assessment yourself weighs heavily in the overall picture. With large-scale tracking, profiling of visitors or sensitive data, an assessment of privacy risks may be in order; that is a separate process with its own time investment, separate from the standard items above.
Also the question of whether you handle this once or keep updating it changes the cost picture. A web shop changes: a new tool is added, a supplier changes its terms, or the law itself gets an update through new guidelines. Having a privacy statement written once is a fixed cost item; keeping track of which data processing agreements are still current and which tools have been newly added is a recurring task. That latter is exactly where an ongoing system differs from a standalone document: the register and the monitoring around it flag changes instead of you having to keep checking yourself.
Free versus paid at gdpria.eu
The knowledge base, the privacy notice generator, the check on a data processing agreement that a customer or supplier sends you, and the decision tree for a potential data breach are free and can be used without an account. What is paid for is the system around it: the processing register that is automatically populated from the library of known tools, the monitoring of active data processing agreements, and the deadline automata for the statutory clocks in the event of a data breach or a request from a data subject. On the pricing page and related information you will find what is included in the subscription and what you get in return.
If you want to see first where your website or web shop stands exactly before you spend money, then the free knowledge base is a logical starting point: search for the tool you use and read what normally applies to it. For the question where that information comes from, on the page about our approach the source in the GDPR and the guidelines of the EDPB and the Dutch Data Protection Authority are included.
This text is intended to be descriptive and not legal advice on your specific website or web shop. If you are unsure about a clause in a data processing agreement or about the necessity of a DPIA, then a lawyer or the Dutch Data Protection Authority is the right party to assess that.
If you want to quickly know which components apply to your own website or web shop, do the free quick scan or create a business account to have the register run alongside the tools you already use.