GDPR software cost by company size: what a 5, 30 or 150-person company pays

What GDPR software costs depends less on your revenue than on three things: how many websites you run, how many people need access, and whether you must keep registers, answer requests and assess risks inside the tool. A one-person business can often pay nothing. A company with a few sites and a real register pays tens of dollars a month. A group with several entities is usually sent to a sales call.

This guide sorts published prices by company size. Every figure comes from the vendor's own pricing page, read on 13 November 2026. Prices change often, taxes are extra, and none of this is a quote or legal advice.

#Why does company size change the bill?

Size does not change the law. The GDPR applies to a two-person shop and a bank alike. What changes is the amount of work, and the work is what tools charge for.

• Websites and traffic. Cookie banners are priced per domain, and often by pageviews or subpages. More sites or more traffic means a higher tier.
• People. Small plans include one user. Teams pay for seats or move to a higher plan.
• Records. A company with staff, customers and many tools has more processing activities, vendors and requests to track. Registers and request tools sit in the upper tiers.
• Entities. Groups with several legal entities often pay per entity. One vendor's calculator shows a "large company, 3 entities" example as a ×1.75 multiplier.

Recital 13 of the GDPR also mentions a derogation on record-keeping for organisations with fewer than 250 employees. It is narrow: most companies that process customer or staff data regularly still keep a record. Our guide to Article 30 records explains when it applies.

#What does each company size typically pay?

These ranges are built from the plans in the next table. They describe software only, not the time your team spends or outside advice.

#Which prices are published?

As of 13 November 2026, from each vendor's pricing page:

Termly was showing a time-limited discount for new customers when we read it. We list the regular prices.

#What would three example companies pay?

These are illustrations from list prices, not quotes. Your traffic, number of sites and the features you pick will change the result.

Acme Bakery, 5 people, one website, 8,000 pageviews a month. It needs a privacy policy, a cookie policy and a banner. A free plan can cover that on Termly (10,000 banner views) or CookieYes (5,000 pageviews, so the traffic would push it to Basic at $10 a month). Expect $0 to $15 a month.

Acme Studio, 30 people, three websites, a register and requests to answer. On Termly Pro+, three websites cost three licenses: 3 × $15 = $45 a month billed annually, with consent logs and a request form. On iubenda, the register and rights tool sit in Ultimate at $99.99 a month per site billed yearly, so the price grows with each site that needs it. A per-workspace tool covers the three sites in one plan.

Acme Group, 150 people, three entities, several people working on compliance. Here the register, impact assessments, breach log and team access matter more than the banner. Quote-based suites become the norm. Witik's page shows its GDPR module from €10,800 a year and cookies from €1,200 a year, on a 36-month commitment paid yearly, with the price adjusted for company size and entities.

#What else costs money besides the software?

The licence is rarely the biggest line. Budget for:

• Time. Someone has to list your tools, describe your activities and keep them current. A tool that pre-fills from a catalog or an import saves hours, not dollars.
• A data protection officer, when you need one. Some companies must appoint one; many choose an external DPO. See do you need a DPO.
• Legal review. A lawyer reviewing your documents once is common for companies with sensitive data or complex transfers.
• Commitment. Multi-year contracts lower the yearly price but lock you in. Read the notice period before signing.
• Overage. Pageview-based plans bill extra traffic. A busy month can cost more than the plan.

#Where does Privacyboard fit?

Privacyboard prices per workspace, one company or website each. Free costs $0 and includes policies, registers, a privacy center and a banner on one domain for one person. Pro costs $24 a month for 2 people and 3 domains, and Business $129 a month for up to 50 people and 10 domains. Prices are in US dollars, before tax.

#Budget checklist before you buy

• Count your websites and their monthly pageviews.
• Count who needs access: one person, a small team, or several departments.
• List what must live in the tool: banner only, or also a register, requests, impact assessments and breaches.
• Check whether the price is per site, per seat, per entity or per workspace, and multiply.
• Look for overage fees on traffic and the price of extra sites.
• Read the commitment length and how to cancel.
• Add taxes: most prices exclude VAT.
• Ask for a written quote when no price is published.

#FAQ

#How much does GDPR software cost for a small business?

As of 13 November 2026, a small business with one website can start at $0 on several published plans. With a few sites, consent logs and a register, published prices we read run from about $45 to $100 a month.

#Do I pay per website or per company?

It depends on the vendor. Cookie tools and policy generators mostly charge per website or domain. Some workspaces charge per company. Enterprise platforms often charge per module and per legal entity.

#Why do larger companies get quotes instead of prices?

Their needs vary: number of entities, integrations, workflows, support. Vendors price these case by case. Witik, for example, publishes starting prices but sets the final terms in a quote.

#Is a free plan enough to comply with the GDPR?

No tool makes you compliant on its own. A free plan can cover the documents and banner of a small site. Whether that is enough depends on what data you process and what you must record, not on the plan.

#Are prices with or without VAT?

The pages we read show prices before tax. iubenda and Witik say so explicitly. Add the VAT of your country.

#Sources

• Regulation (EU) 2016/679 (GDPR), recital 13 and Article 30, EUR-Lex.
• Termly pricing, read 13 November 2026.
• iubenda pricing, read 13 November 2026.
• CookieYes pricing, read 13 November 2026.
• Witik pricing, read 13 November 2026.
• Privacyboard pricing.