GDPR Compliance Cost Calculator

What GDPR is

The General Data Protection Regulation (GDPR) is Regulation (EU) 2016/679. The European Parliament and the Council adopted it in April 2016, and it has applied since 25 May 2018, replacing the earlier Data Protection Directive 95/46/EC. Unlike a directive, a regulation applies directly in every member state, which is why it created one set of rules for personal data across the whole EU.

It covers any organisation that handles personal data of people in the EU, wherever the organisation is based. Its main building blocks are lawful bases for processing (consent is only one of six), individual rights such as access, correction, erasure and portability, duties to keep records and secure data, and a requirement to report certain breaches to the regulator within 72 hours. The most serious infringements can be fined up to 20 million euros or 4% of worldwide annual turnover, whichever is higher.

Compliance is not free. Companies pay lawyers, consultants and engineers, redesign forms and databases, and train staff. This calculator exists to put an order of magnitude on that effort and to express it in terms that are easier to grasp than a number with eleven digits.

How the estimate is built

The figures are deliberately coarse. They are one-time estimates of the cost of getting ready, assembled from published survey data on corporate GDPR budgets (notably a 2017 PwC pulse survey of large firms with a European presence), company-count statistics from the US Census Bureau and Eurostat, and a series of assumptions about how many firms of each size are affected and what they spend.

They leave out the costs that continue after launch: data protection officers, audits, legal disputes, fines and the lost time of staff who now handle extra paperwork. Read every number as the lower part of a plausible range rather than a measurement.

Currency conversion uses fixed rates built into the tool: 1 dollar = 0.894505 euros = 0.82885 pounds. They are not live market rates, so treat euro and pound totals as indicative.

Prices used for the comparisons

Each comparison divides the dollar estimate by a unit price and rounds to the nearest whole unit. The prices are round figures meant to be typical rather than exact, and the aid items refer mainly to relief delivered in Africa.

A worked example

count = region cost in USD ÷ price of one itemRounded to the nearest whole item.

For the whole world, the $322,616,000,000 estimate divided by the $10 price of a pizza is 32,261,600,000 pizzas. The same sum covers 1,613,080,000 wheelchairs at $200 each, or 403,270,000 iPhones at $800.

For the EU alone, $239,226,000,000 ÷ $540,000 is about 443,011 cancer research projects. Expressed in labour, the world estimate corresponds to 322,616,000,000 ÷ 60 = 5,376,933,333 man-hours, which equals roughly 2.7 million people working a standard 2,000-hour year.

Switching the currency changes the total shown in the cost box but not the count: 322,616,000,000 dollars is 288,581,625,080 euros, and the same purchasing power buys exactly the same number of items.

What the numbers can and cannot tell you

• They are one-time costs. Ongoing compliance is not included, so true cumulative spending is higher.
• They are not net costs. Spending on data security, record keeping and better data hygiene also has value for the companies that make it, and the calculator does not try to measure that benefit.
• They are not exact. Survey samples are small and skew toward large firms. Small businesses, public bodies and non-profits are modelled with assumptions, not measurements.
• Comparisons are illustrations. A pizza count is a way of feeling scale, not a claim that the money would otherwise have been spent that way.

This calculator gives rough illustrative estimates only. It is not legal, financial or compliance advice. See our disclaimer, and speak with a qualified data protection professional about your own obligations.

Where compliance work usually starts

There is no certificate that proves you are GDPR compliant, and regulators and courts continue to refine how the text is read. Organisations typically work through the same sequence of tasks.

1. Map the personal data you hold: what it is, where it lives, who can reach it and why you collect it.
2. Assign a lawful basis to each purpose, and make sure that where you rely on consent it is freely given, specific, informed and easy to withdraw.
3. Update privacy notices so people can see what happens to their data, and set up a way to handle access, correction, deletion and portability requests.
4. Put written contracts in place with every processor that handles data for you, and check how data leaves the EU.
5. Secure the data with sensible technical and organisational measures, keep records of processing and prepare a breach response plan with the 72-hour reporting window in mind.
6. Appoint a data protection officer where the rules require one, and carry out impact assessments for high-risk processing.