GDPR
What does GDPR compliance cost a small Irish business?
There is no fee to comply with the GDPR and no certificate to buy. A small business pays mostly in time: a few documents, a few settings on its website and systems, and a contract with each supplier that handles personal data for it. Published help in Ireland runs from free official guidance and a free software plan to €17,000 a year for a consultancy subscription.
By Oscar CobbeCurrent as at 5 minute read8 sources
What you pay for
The GDPR asks for things to be done and shown, not bought. For a small business, the work is in these pieces. Our GDPR guide for a small Irish business sets out the law behind each.
Four of them have a guide of their own: what a website privacy notice must say, cookie banners in Ireland, the record of processing and whether you need a DPO.
| Piece of work | Where the GDPR asks for it | What it costs |
|---|---|---|
| A privacy notice your customers can read | Articles 12 and 13 | Your time, or a solicitor's |
| Cookie consent on the website | Regulation 5(3) of the ePrivacy Regulations (S.I. 336 of 2011): consent, after clear information | A consent tool, and setting it so nothing tracks before a visitor chooses |
| A contract with each supplier that handles personal data for you | Article 28(3) | Usually the supplier's own data processing terms, which you accept |
| A record of how you use personal data | Article 30. The exemption in 30(5) for fewer than 250 staff does not cover processing that is not occasional | Your time, a template, or software |
| Security appropriate to the risk | Article 32 | Two-step sign-in, backups, and the rest of the basics an insurer also asks about |
| A data protection officer | Article 37(1), for public bodies and for large-scale monitoring or special-category data as a core activity | Nothing, if the duty does not apply to you |
The Article 30 exemption is narrow
Article 30(5) lifts the duty to keep a record from an organisation with fewer than 250 staff, unless its processing is likely to be a risk to people, is not occasional, or includes special-category or criminal-conviction data. The Article 29 Working Party's paper on the exemption gives the example: a small organisation is likely to process data about its employees regularly, so that processing is not occasional and goes in the record. The same paper says a record is unlikely to be a heavy burden for many small organisations.
What published help costs
As each business or body published it on 22 October 2026.
| Option | Published price | What it covers |
|---|---|---|
| The Data Protection Commission and the EDPB | Free | The DPC's guidance for organisations, with a self-assessment checklist; the EDPB's data protection guide for small business |
| PrivacyEngine, free plan | Free, for up to 5 staff | Software for the record of processing, risks, a DPIA, logs and training, each up to its plan's limits; paid plans are priced through a demo |
| BH Haven, Foundation plan | €17,000 a year (1 to 10 employees) | GDPR governance, including the record of processing and DPIA support, with cyber security and AI governance, and two consulting days |
| FourWinds, Secured and proven | €2,950 up to 10 staff, once | Cookie consent set so nothing tracks before a visitor chooses, a privacy notice naming every tracker and service the scan saw, the security basics, a practised incident plan, and an evidence pack |
| FourWinds, Compliance assessment | Quoted after a call | The record of processing built from the systems you run, a DPIA where Article 35 asks for one, and gaps ranked by risk, kept live in the portal |
The big figures you will find
A search for this question turns up a 2019 survey by Mazars and McCann FitzGerald, reported in the Law Society Gazette, in which 58% of businesses put their GDPR costs to date between €50,000 and €250,000. The Gazette notes that many of the respondents were organisations for which a data protection officer is mandatory. That is a different business from a ten-person practice or shop, and the figure does not transfer.
Sources
- 1.Regulation (EU) 2016/679, the GDPR: Articles 12, 13, 28, 30, 32, 35 and 37 · EUR-Lex, Publications Office of the European Union
- 2.Position paper on the derogations from the obligation to maintain records of processing activities, Article 30(5) · Article 29 Working Party
- 3.S.I. No. 336 of 2011, the ePrivacy Regulations: Regulation 5(3) · Irish Statute Book, Office of the Attorney General
- 4.For organisations: resources for organisations · Data Protection Commission
- 5.Data protection guide for small business · European Data Protection Board
- 6.PrivacyEngine pricing · PrivacyEngine
- 7.Plans, Ireland / EU · BH Haven
- 8.GDPR compliance costs of up to €250k reported, January 2019 · Law Society of Ireland Gazette
Free, and no account needed
See what your website shows a regulator, free
The free compliance check looks at your website from outside: what tracks a visitor before they choose, and whether the privacy notice is linked. It reads your email records too, and asks a few questions about the business. Kept, with a free account, it becomes a compliance record with the statutory clocks on it.
Run the free checkThe website and security parts, done and proven
Secured and proven sets cookie consent so nothing tracks before a visitor chooses, writes a privacy notice that names every tracker and service, and does the security basics Article 32 points to, with a second scan and an evidence pack. From €2,950 up to 10 staff, fixed before we start.
Secured and provenWho wrote this
Oscar Cobbe · Founder, FourWinds Digital
Writes and maintains the legal explainers on this site, and does the compliance work behind them. Every date and article number here is checked against the legislation itself before it is published, and updated when the law changes.
More about how we work →Read next
- GDPRGDPR for a small Irish business, and what the Data Protection Commission deals with
- GDPRA record of processing for a small Irish business: what goes in it, and whether you need one
- GDPRDoes a small Irish business need a Data Protection Officer?
Written on 22 October 2026 and accurate as at that date. This is general information about how the rules work, not legal advice on your situation. Where you need a solicitor, we say so.