Reviewed by TRUST-IT ·
Request a GDPR scope and cost estimate
DECISION BRIEF
What you will be able to decide
For: Business owners, procurement teams and privacy leads comparing GDPR consulting proposals.
Define a comparable scope, realistic dependencies and verifiable deliverables before asking for a price.
- Compare the entities, processes and systems included in each proposal.
- Separate assessment, implementation support and ongoing advisory work.
- Tie milestones to deliverables and review criteria, with explicit exclusions.
A useful GDPR consulting proposal explains the work behind the fee. Define the processing activities, entities, systems and support required, then compare deliverables and responsibilities on the same basis.
What influences the scope and cost?
Start with the organisation’s actual processing: customers, employees, suppliers, online services and any other activities in scope. Identify the entities, locations, systems, data flows and external providers involved. The number of staff alone does not describe the effort. A small team operating a complex platform may require different work from a larger organisation with a narrow, well-documented processing model.
Existing records, availability of process owners, quality of supplier information and maturity of technical controls affect the assessment. An engagement may require interviews, document review, data-flow validation, security input and coordination with legal advisers. Ask the provider to identify assumptions, missing information and dependencies before treating a fee or timetable as firm.
Separate assessment, implementation and ongoing support
An assessment identifies gaps and priorities within an agreed scope. Implementation support helps the organisation make defined changes. Ongoing advisory work maintains an agreed service over time. These are different commitments. A proposal should state which records, policies, reviews, meetings and technical activities are included in each stage.
A fixed fee is meaningful when the boundaries and acceptance criteria are clear. Time-based work needs agreed roles, effort controls and approval for additional scope. A recurring arrangement needs defined coverage, availability and exclusions. These are contracting approaches, not published TRUST-IT tariffs; a quotation follows an assessment of the required work.
Fixed fee, day rate or monthly support?
Choose the charging model around the uncertainty and continuity of the work. These are terms to request when comparing proposals, not a list of standard TRUST-IT packages. Confirm the amount, applicable taxes, expenses, payment milestones and exclusions in the written proposal.
Swipe across the table to see all columns.
| What to agree | Fixed project fee | Day rate | Monthly advisory arrangement |
|---|---|---|---|
| Best fit | A bounded assessment, defined document set or implementation stage with reviewable outputs. | Discovery or specialist work whose effort cannot yet be estimated reliably. | Recurring advice and a defined programme of reviews after an initial baseline is established. |
| Included work | Named entities, processes, deliverables, meetings and revision rounds. State which implementation tasks are included. | Named role and seniority, billable day length, planned tasks and a record of work completed. | Reserved hours or days, review cadence, request types, reporting and whether unused capacity expires or carries forward. |
| Cost control | Milestones and acceptance criteria; assumptions about evidence quality and access to process owners. | Estimated effort and a ceiling or stop-and-review point. Review progress against outputs, not only time consumed. | Monthly allowance and priorities; distinguish reserved capacity from unlimited access to specialists. |
| Additional work | A new system, entity or deliverable requires a written change showing the additional fee and schedule impact. | Agree the extra task and effort before exceeding the approved limit. Do not treat a timesheet as approval for new scope. | Agree overflow rates and authorisation before exceeding the allowance; price a substantial new project separately. |
| Availability | Delivery checkpoints depend on the agreed timetable and the client supplying required information. | Book specific working days; a day rate does not establish immediate availability. | Define working hours, response expectations, escalation and substitute cover explicitly. |
| Exclusions and dependencies | Identify legal opinions, engineering changes, penetration testing, travel and third-party fees where not included. | State preparation, travel, meetings, reporting and expenses that count towards billable time. | State whether incident response, formal DPO services, litigation support or major remediation require separate arrangements. |
Questions about GDPR consulting fees
How much does a GDPR consultant cost per day?
A day rate is only comparable when the role, working-day length and billable activities are the same. Request the rate together with estimated days, expected outputs, expenses and a maximum authorised spend. TRUST-IT provides a scoped proposal; this guide does not state a standard daily tariff.
Is a fixed fee cheaper than a monthly retainer?
Neither is inherently cheaper. Compare the cost of completing and maintaining the same work over the same period. A fixed assessment may leave implementation with your team; a monthly arrangement may include advice but exclude the initial assessment. Add internal effort and separately charged tasks before comparing totals.
Does a monthly GDPR fee include a DPO or emergency response?
Only when those services are explicitly included in the agreement. A recurring consulting arrangement alone does not define a DPO appointment, continuous monitoring or emergency availability. Ask for the role, coverage, responsibilities and escalation route in writing.
How can we obtain a useful quotation without sending personal records?
Describe the entities, processing activities, principal systems, existing documentation and desired outcome. Identify the internal coordinator and target date. Share confidential documents only after agreeing a suitable exchange process; an initial enquiry should not contain unrestricted personal datasets.
Use the GDPR engagement scoping guide to prepare a comparable brief.
Compare complete proposals rather than isolated fees
Build a comparison table using the same entities, processing activities and systems. Record deliverables, interviews, implementation tasks, internal effort, review rounds, supplier dependencies and exclusions. Ask whether the price includes the work needed to put recommendations into operation, or only to document them.
For each milestone, define the output and who reviews it. A processing inventory should reflect the agreed activities and named owners; a remediation plan should connect actions to responsible people and evidence of completion. Where legal interpretation, specialist security testing or software changes are needed, identify the responsible adviser or team and whether that work is included.
Control changes and prepare the organisation
Nominate an internal coordinator and make the relevant process owners available. Gather existing records, contracts, notices, incident procedures and system information through an agreed secure channel. The initial request should be proportionate: there is usually no reason to email unrestricted copies of live personal datasets merely to obtain an initial quotation.
Agree how new entities, systems or processing activities change the scope. Record the additional work, dependency, fee basis and approval before it begins. Separate delays caused by unavailable information from the provider’s delivery effort. Include a review checkpoint so the organisation can decide whether the next stage is justified by the evidence collected.
Define useful outcomes and continuing responsibilities
The engagement should leave the organisation with usable records, prioritised actions, named owners and an agreed review process. Confirm who maintains the material after handover, who implements technical changes and how unresolved questions are escalated. Recurring reviews should respond to changes in processing, suppliers and systems rather than depend only on a calendar reminder.
The EDPB’s business guide is a useful starting point for understanding data-protection topics. Applicability and legal interpretation depend on the organisation’s circumstances and appropriate advice. Buying a report, policy pack or consulting engagement does not by itself establish compliance. The relevant result is documented, maintainable work with clear operational responsibility.
EDPB: Data protection guide for small business
WORKED EXAMPLE
Two proposals cover different work
Illustrative scenario, not a client case. A company with two entities and an online customer portal receives two GDPR proposals. One includes interviews and a gap report; the other also includes data mapping, supplier review, implementation support and a follow-up evidence review.
- Evidence and checks
- Procurement creates a common scope table covering entities, processing activities, systems, interviews, documents, implementation tasks, internal effort and exclusions. The privacy lead identifies which decisions require legal input and which technical controls require engineering work. Each provider states dependencies and how additional work is approved.
- Supported conclusion and next action
- The buyer can compare equivalent deliverables and total effort rather than headline fees. The final engagement identifies who implements recommendations, what demonstrates completion and which ongoing tasks remain with the organisation. Neither a report nor a purchased document pack guarantees compliance.
From business scope to an accountable proposal
Price becomes meaningful when the work, responsibilities and acceptance criteria are visible.
- MapEntities, processing and systems
- AssessEvidence, gaps and priorities
- ScopeTasks, exclusions and owners
- ImplementAgreed changes and support
- ReviewEvidence, open work and handover
This guide does not publish a TRUST-IT tariff. Fees and timing are agreed after the required work and dependencies have been assessed.
What to request from your provider
Use these criteria to compare the proposed work and review the result. The scope and acceptance checks should be agreed before delivery.
Swipe across the table to see all columns.
| Deliverable | What it includes | Acceptance check |
|---|---|---|
| Scope schedule | Entities, locations, processes, systems and exclusions. | Different proposals can be compared against the same boundaries. |
| Deliverable register | Reports, records, policies, review meetings and formats. | Each milestone produces a specified, reviewable output. |
| Implementation responsibility | Provider tasks, internal work and legal or technical dependencies. | Every action has an owner; recommendations are not confused with implementation. |
| Change and handover terms | Additional-scope approval, review rounds and ongoing maintenance. | New work is agreed explicitly and recurring responsibilities are clear. |
TAKE THIS INTO YOUR NEXT MEETING
Your preparation checklist
- List entities, locations, processing activities and critical systems.
- Describe current documentation and the evidence available.
- Separate assessment, implementation and ongoing support.
- Identify internal owners and required legal or engineering input.
- Request deliverables, exclusions and acceptance criteria in writing.
- Agree change control, review rounds, handover and recurring tasks.
Use the bilingual workbook for notes or the editable CSV to assign owners and evidence references. These are preparation templates, not a completed assessment.
Turn your preparation notes into a scoped request
Tell us which entities and systems are in scope, what documentation exists and whether you need assessment, implementation support or ongoing advice. Include your target date and the person coordinating the work.
A proposal follows a review of the required work and dependencies. Fees, deliverables and responsibilities are agreed before work begins.
Use a short description in the enquiry form; do not include personal records or confidential documents.