EU regulation · Last verified 2026-05-13

GDPR

Bottom line

GDPR is an EU regulation, not a certification framework. Compliance is self-attested and enforced by national Data Protection Authorities; no pan-EU certification scheme exists at scale. Initial program build runs €30K–€500K+ over 6–18 months.

Cost & timeline €30K–€500K+ program / 6–18 months

One of 10 compliance framework explainers we maintain.

Key facts

Controls: 99 articles across 11 chapters; ~78 enforceable obligations
Recertification cycle: Continuous regulatory compliance (no expiry)
Ongoing oversight: DPA-led investigations, typically triggered by complaints or reported breaches
Common gap categories: Lawful basis documentation (Art 6); Data subject rights workflows (Art 12–22); Records of Processing Activities (Art 30); Data Protection Impact Assessments (Art 35); International transfer mechanisms (Chapter V, SCCs)
Related standards: UK GDPRePrivacy DirectiveSwiss FADPISO 27701

What is GDPR?

The EU General Data Protection Regulation (European Parliament and Council, enforced May 25, 2018) governs the collection, processing, and transfer of personal data of EU and EEA residents. It applies to any organization worldwide that handles such data.

Is GDPR a certification or an attestation?

GDPR is a regulation, not a certification framework. There is no issuing body that grants a GDPR certification. Article 42 allows for voluntary national certification schemes approved by supervisory authorities, but no pan-EU scheme exists at scale. Compliance is self-attested and enforced by national Data Protection Authorities (DPAs).

Who needs GDPR?

Required implicitly by any company with EU customers, employees, or data subjects. Most commonly demanded as a contractual prerequisite by European enterprise buyers, SaaS procurement teams, and any company signing EU Standard Contractual Clauses.

What does GDPR cost and how long does it take?

Range

€30K–€500K+ program / 6–18 months

Highly variable. SME-to-mid-market initial program build typically €30K–€500K+ over 6–18 months, with ongoing costs settling near 35–40% of year-one spend.

Source: IAPP: Timelines and budgets for GDPR compliance ↗

One thing to watch

GDPR cost ranges span 2–3 orders of magnitude based on company size, data volume, and starting posture. Treat the range as a compliance program investment, not an audit fee.

Sources

Last verified 2026-05-13. Found a stale or wrong source? Email hello@soc2auditors.org.

Go deeper on this

SOC 2 vs GDPR (long read) →

Other frameworks buyers ask about

SOC 2 Type 1 $7.5K–$30K / 3–6 months SOC 2 Type 2 $12K–$100K / 6–15 months ISO 27001 $10K–$80K audit / 6–18 months HIPAA $4K–$60K assessment / 2–8 weeks PCI DSS $1K–$200K / 3–12 months FedRAMP $250K–$3M+ / 12–36 months

See all frameworks →