GDPR compliance costs most startups roughly $10,000–$40,000 to get in place — there’s no certificate, so the cost is data mapping (RoPA), policies, Data Processing Agreements, tooling and legal or consulting time, plus ongoing upkeep. It’s what European customers and regulators expect once you handle EU personal data. With Folksoft, most startups reach a defensible GDPR posture in weeks for a fraction of the consulting route — a real GRC analyst, not a dashboard.
What most startups pay across data mapping, policies, DPAs, tooling and legal time — for a team of 11–25 on simple infrastructure.
Those are open-market figures. Leave your name and work email and someone from our team will come back to you with your price for this exact scope, or book a call and talk it through.
Indicative ranges based on what early-stage startups typically pay in the US and European markets — your figure depends on scope, cloud footprint and how much personal data you process and how many processors you share it with.
There is no GDPR certificate and no auditor to pay, so every dollar buys the programme itself — and the programme never finishes.
Mapping what personal data you hold, where it flows and why (the Record of Processing Activities), then writing the privacy notice, the retention and breach policies, and the Data Processing Agreements with every processor. It prices on how many systems and vendors touch personal data, not on headcount.
An annual licence to hold the RoPA, the policies, the DPAs, consent records and the log of data subject requests. Most vendors price per employee, and it renews every year — GDPR being a standing obligation rather than a one-off project.
The line nobody budgets for. Engineers and ops tracing personal data through every system, building deletion and export for data subject requests, tightening access, and answering the privacy questionnaires European customers send. It scales on headcount and on how many environments hold personal data.
A Data Protection Officer is mandatory only for some processing, and an EU representative only if you have no establishment in the EU. Where one is required, most startups outsource it rather than hire — a recurring annual fee on top of the three lines above.
GDPR has no certificate and no end date, so the first year buys a programme you then keep running.
Map the data, write the policies, sign the DPAs, and put the processes in place for access, deletion and breach reporting. You come out with a defensible GDPR posture you can show a European customer.
Keep the RoPA current as systems change, sign DPAs with every new vendor, answer data subject requests on the clock, and review policies and training each year. This is the cost that never stops, and the one most budgets leave out.
There is no GDPR certificate you are required to hold. What a regulator or a European customer asks to see is the programme: a current RoPA, signed DPAs, working processes for data subject requests and breaches, and evidence you keep them up. See the full GDPR programme.
Most of the savings are in collecting and keeping less personal data, not in shopping for a cheaper lawyer.
Every field you stop collecting and every record you delete on schedule is one less thing to map, protect, disclose and hand back on request. Data minimisation is a GDPR principle and the cheapest control on the list.
A policy written before you know where the data flows gets rewritten once you do. Build the RoPA first and the privacy notice, retention schedule and DPAs follow from it, with no second pass.
AWS, Google Cloud, Azure and most SaaS processors publish a standard Data Processing Agreement, usually with the EU Standard Contractual Clauses built in. Paying a lawyer to draft one per vendor is the most avoidable line on the bill.
ISO 27001 and SOC 2 cover most of the security measures GDPR’s Article 32 asks for. Running them through one programme costs far less than separate projects — toggle them in the calculator above to see the difference.
There is no certificate to buy, so the money goes on the programme: legal and consulting time for data mapping, policies and Data Processing Agreements ($8,000–$20,000), privacy and GRC tooling ($5,000–$12,000 a year), and your own team’s time (from $10,000, rising with headcount and how many systems hold personal data). A team of 11–25 on simple infrastructure typically lands at $27,000–$38,500. Folksoft covers the same scope for less. What that comes to depends on your data, so we price it properly rather than guessing at it here — leave your details on the calculator above and we’ll come back with your price.
Not one you need. Article 42 of the GDPR allows for voluntary certification schemes approved by regulators, but very few exist, none is mandatory, and holding one does not make you compliant. There is no GDPR audit to pass and no certificate to renew. What a regulator or a European customer asks to see is evidence of the programme: a current Record of Processing Activities, signed DPAs, a privacy notice that matches what you do, and working processes for data subject requests and breaches.
Only in specific cases. A DPO is mandatory when your core activities involve large-scale, regular and systematic monitoring of people, or large-scale processing of special-category data such as health data — most early-stage SaaS companies do neither. Separately, a company with no establishment in the EU that sells to or monitors people there usually needs an EU representative. Where either is required, most startups outsource it rather than hire, at roughly $5,000–$15,000 a year.
GDPR does not end once you are compliant. Every year the RoPA has to track new systems, every new vendor needs a DPA, data subject requests have to be answered within a month, and policies and staff training need reviewing. The tooling licence renews, and an outsourced DPO or EU representative, if you need one, adds $5,000–$15,000 a year. Switch the calculator above to “Ongoing programme” to see the annual figure for your team.
Two to four months on the open market to reach a defensible posture, from data mapping through to signed DPAs and working processes. There is no audit to schedule and no observation window, so almost all of that time is readiness work. Folksoft gets startups there in weeks. After that, GDPR is an ongoing programme rather than a finished project.
Fifteen minutes on a call and we’ll map where your personal data goes, name the price and give you a date for a defensible GDPR posture.