Real-world Data Protection Impact Assessment costs range from EUR900 for a simple, in-house assessment to EUR32,850 for a fully outsourced one, according to a 2019 case study built on 16 interviews with data protection officers and consultants working on Flemish Smart City projects. That thirty-six-fold spread is not a data error: it reflects how much project complexity and the choice between in-house and outsourced work actually move the price of a single legally required document.
A DPIA is not optional once a processing operation is likely to result in a high risk to people's data, and GDPR Article 35 has required one since 25 May 2018. Yet unlike fines or breach settlements, DPIA costs rarely get measured at all, so the handful of studies that exist carry outsized weight. Below is what those studies actually found, broken down by complexity, by time investment, and by how many organizations skip the exercise entirely.
How much does a DPIA cost, from simplest to most complex?
The most detailed publicly available breakdown comes from the SPECTRE research project at the Free University of Brussels, funded by the Research Foundation Flanders. Researchers interviewed 16 data protection officers and consultants, five from public-sector organizations, five from private companies, and six external consultants, about the real costs of conducting a DPIA. Total costs ranged from about EUR900 for a simple data processing operation handled entirely in-house to EUR32,850 for a complicated operation with the DPIA fully outsourced.
Figure 1: Total DPIA cost across three delivery models. Source: SPECTRE project, "Economic costs of the DPIA" (2019), 16 expert interviews.
| Delivery model | Time investment | Total cost |
|---|---|---|
| In-house, simple project | About 16 working hours | About EUR900 |
| In-house, complex project | About 20 working days | About EUR9,000 |
| Fully outsourced (consultant plus internal team) | 30-plus consultant days | About EUR32,850 |
Table 1: DPIA cost by delivery model. Source: SPECTRE project (2019).
A private-sector data protection officer interviewed for the same study independently estimated an outsourced DPIA at close to EUR30,000, a figure close enough to the EUR32,850 case to suggest the outsourced range is not a one-off. Outsourcing is common practice in both the public and private sector when in-house legal or technical expertise is thin, but the researchers noted that engaging external experts can roughly double the cost of performing the same DPIA internally.
How much time does a DPIA actually take?
Personnel time is the single biggest driver of DPIA cost, and it scales sharply with complexity. The SPECTRE case study found a simple in-house DPIA took about 16 working hours, close to two full working days, while a more technically advanced, data-intensive project took about 20 working days for the same in-house work. A separate November 2022 survey of 42 data protection experts by the compliance vendor ECOMPLY found that a manual, spreadsheet-based DPIA can consume more than 30 hours of work, roughly three to four full working days, using tools like Microsoft Word, Excel, or the CNIL's free PIA software.
Figure 2: Time investment against total cost for each delivery model. Source: SPECTRE project (2019).
That time gap explains most of the price gap between a simple and a complex DPIA: at a comparable expert day rate, twenty working days simply costs ten times more than two. It also explains why so many teams skip DPIAs when they should not: a project manager filling out a template alone underestimates how many people actually need to be consulted before the document is defensible. You can reduce the drafting portion of that burden, though not the risk-assessment work itself, by starting from a current, GDPR-ready privacy policy that already documents the legal basis and data flows a DPIA has to reference.
Why do some DPIA cost estimates go as high as EUR149,000?
Before GDPR took effect, the European Commission published its own regulatory impact assessment in 2012, modeling DPIA costs for three example data processing scenarios. A basic behavioral advertising system was estimated to need a small-scale DPIA costing around EUR14,000. Integrating location-based advertising into a mobile service was estimated at around EUR34,000. A camera-based surveillance system with biometric capabilities, given the sensitivity of the data involved, was estimated at EUR149,000.
Figure 3: How DPIA cost estimates have evolved since before GDPR existed. Source: European Commission (2012), Christensen et al. (2013), SPECTRE project (2019), ECOMPLY (2022), EDPS (2025).
Treat the EUR149,000 figure as a historical estimate rather than a current benchmark: it predates the regulation it was meant to justify by six years and has never been tested against real post-GDPR DPIA practice. A separate 2013 analysis by Christensen, Colciago, Etro, and Rafert took a narrower view, estimating the GDPR-specific costs tied to data-protection-by-design and DPIA obligations alone at EUR688 to EUR2,236 per small or medium-sized enterprise, depending on industry sector. Both studies are now more than a decade old and predate the GDPR's final text, so read them as the origin point for DPIA cost estimation, not as figures a business should budget against directly today.
Which step of a DPIA costs the most?
A DPIA under GDPR Article 35 breaks down into five steps: describing the processing and its purposes, assessing necessity and proportionality, assessing the risks, addressing those risks and demonstrating compliance, and periodically reassessing. The SPECTRE interviews found the first step, describing the data flows and their purposes, is traditionally the most expensive, mostly because of the personnel time needed to track down scattered information across departments and IT systems. The fourth step, addressing risks, is a close second and depends heavily on whether new technical solutions need to be purchased.
Figure 4: Relative cost intensity of each DPIA step under GDPR Article 35. Source: SPECTRE project (2019), based on 16 expert interviews.
Step 2, assessing necessity and proportionality, is usually the cheapest of the five, since checklists cover most cases quickly. One consultant interviewed for the study warned that treating this step too lightly is its own risk: skipping a DPIA when one was legally required, or performing one when it was not, can create a far larger cost than the assessment itself would have. Step 5, the periodic reassessment, tends to stay cheap as long as the original DPIA was thorough enough to serve as a baseline the next time the processing changes.
How many organizations actually complete a DPIA?
Most organizations subject to GDPR say they have done at least one DPIA, but the share that treats it as a routine, well-documented process is smaller. A 2018 benchmarking survey by IAPP and TrustArc, fielded to IAPP's Daily Dashboard subscriber list between 23 October and 6 November 2018 and drawing 496 responses, found 75% of respondents subject to the GDPR had completed one or more DPIAs, though most had completed fewer than five since the regulation took effect.
Figure 5: Share of surveyed EU institutions using the regulator's own DPIA template versus a custom process. Source: European Data Protection Supervisor, DPIA Survey 2024 (published September 2025).
Among EU institutions specifically, a more recent and more targeted picture emerges from the European Data Protection Supervisor's own DPIA Survey 2024, published in September 2025 and covering 71 EU institutions, bodies, offices, and agencies. Those institutions had carried out 242 DPIAs combined since 2018, but 31 of the 71 institutions surveyed reported never having conducted a single DPIA, more than a third of the group, even seven years after the obligation began. Of the DPIAs the EDPS did examine, 13% failed to include a systematic description of the processing activity, a basic requirement under Article 35, and 15 out of 79 examined DPIAs failed to demonstrate any assessment of necessity and proportionality at all.
The Bottom Line
DPIA costs are not a fixed line item: they range from roughly EUR900 for a straightforward assessment handled by an in-house team to more than EUR32,850 when a complex project gets fully outsourced, and the European Commission's own decade-old estimates run even higher for the most sensitive processing types, like biometric surveillance. What every study agrees on is that the price scales with two things a site owner controls directly: how well-organized the underlying data flows already are, and whether the assessment gets started early enough to avoid a rushed, expensive scramble later. A current, accurate privacy policy generated for your specific data practices will not replace a DPIA where one is legally required, but it does most of the groundwork a DPIA's first step demands: a systematic description of what data you collect, why, and under what legal basis, which is exactly where the SPECTRE researchers found the most expensive step of the whole process concentrated. For a broader view of what privacy compliance costs beyond DPIAs specifically, see our cost of privacy compliance breakdown.
Frequently Asked Questions
How much does a DPIA cost in 2026? Real-world DPIA costs range from about EUR900 for a simple in-house assessment to EUR32,850 for a fully outsourced one, according to a 2019 case study built on 16 interviews with data protection officers and consultants. In-house DPIAs alone span roughly EUR900 to EUR9,000 depending on project complexity, and outsourcing the same work roughly doubles the price.
How long does a DPIA take to complete? A straightforward in-house DPIA takes around 16 working hours, or about two working days, per the same 2019 case study. A more complex in-house assessment can take about 20 working days. A separate November 2022 survey of 42 data protection experts found a manual, spreadsheet-based DPIA can consume more than 30 hours of work.
Why do some DPIA cost estimates go as high as EUR149,000? That figure comes from the European Commission's own 2012 impact assessment for the GDPR, prepared before the regulation existed. It modeled a camera-based surveillance system with biometric capabilities as the most expensive of three example scenarios, against EUR14,000 for a basic behavioral advertising system and EUR34,000 for location-based mobile advertising. The estimates are more than a decade old and were never updated against real post-GDPR DPIA practice.
How many organizations actually complete a DPIA? 75% of respondents subject to the GDPR said they had completed at least one DPIA, per a 2018 IAPP and TrustArc benchmarking survey of 496 privacy professionals. Among EU institutions specifically, the EDPS's 2024 survey found 31 of 71 institutions had never conducted a single DPIA, even though the obligation has existed since GDPR took effect in 2018.
Where the Numbers Come From
- SPECTRE Project, Vrije Universiteit Brussel. Vandercruysse, L., Buts, C., and Dooms, M. (2019). "Economic Costs of the DPIA." Case study based on 16 semi-structured expert interviews (5 public-sector DPOs, 5 private-sector DPOs, 6 consultants), Flemish Smart City context. Total DPIA costs EUR900 to EUR32,850.
- European Commission. (2012). "Impact Assessment SEC/2012/0072 final," staff working paper accompanying the original GDPR proposal. Pre-GDPR DPIA cost scenarios of EUR14,000 to EUR149,000.
- Christensen, Colciago, Etro, and Rafert. (2013). "The Impact of the Data Protection Regulation in the E.U." Intertic Policy Paper. SME-specific data-protection-by-design and DPIA costs of EUR688 to EUR2,236.
- ECOMPLY. (2022). "What Is the Cost of a DPIA?" Survey of 42 data protection experts conducted November 2022 on time effort required for a manual DPIA.
- IAPP and TrustArc. (2018). "New IAPP and TrustArc Benchmarking Research Reveals Increased Use of Technology to Manage Privacy Operations." Survey fielded 23 October to 6 November 2018 to IAPP Daily Dashboard subscribers, 496 responses.
- European Data Protection Supervisor. (2025). "EDPS DPIA Survey 2024." Published 8 September 2025, covering 71 EU institutions, bodies, offices, and agencies.
Note: All figures verified as of October 2026. The European Commission (2012) and Christensen et al. (2013) figures predate the GDPR's final text and are presented as historical estimates, not current benchmarks. DPIA cost figures are refreshed at least twice a year to track any new academic or regulatory cost studies.
