GDPR 2026: 6 Cost-Saving Tips for SMEs

Savings are possible in the way you implement, not in the catalogue of obligations. Anyone who outsources the data protection officer role, works with templates instead of individual advice and switches tools will reduce spending — the GDPR's designation, documentation, notification and information obligations remain untouched. Each of the six tips therefore names three things: the concrete step, the honest limit and the legal source.

For implementation, a different order than the numbering is advisable, because tips 3, 4 and 6 start from entries in the record of processing activities:

1. Tip 2 — the record and the templates form the basis
2. Tip 1 — the data protection officer advises on the further steps (Art. 39(1) GDPR)
3. Tip 4 — clarifies the recipients for each entry in the record
4. Tip 6 — clarifies the contracts with those recipients
5. Tip 3 — web analytics is added as a separate entry in the record
6. Tip 5 — checks the result

The cost comparison puts the standard route, the low-cost route and the cost drivers of all six tips side by side. Which obligations the catalogue imposes regardless of the choice of tool, provider and mandate — and which triggers depend on the constellation — is set out together in the section Where the savings end.

1. External data protection officer instead of an internal one

An external mandate changes the cost of the function, not the question of whether you have to designate a data protection officer. An internally staffed post costs the full cost of the position; the fee for an external mandate depends on size, sector and scope of support and is to be clarified via quotes. A saving arises above all where a full-time position is actually replaced. You arrive at your own figure from the full cost of the internal position minus the mandate fee quoted (calculation for all three items: FAQ).

The designation obligation has two levels that must always be assessed together: the three EU-wide grounds in Art. 37(1) GDPR and, in Germany, in addition to Art. 37(1)(b) and (c), the threshold in § 38(1) of the German Federal Data Protection Act (BDSG): as a rule at least 20 persons constantly engaged in automated processing. In Austria there is no numerical threshold; there the obligation follows from Art. 37 GDPR alone. All grounds at both levels are set out in the answer "Can we do without a data protection officer altogether?".

Step: assess the obligation against both levels, select the person on the basis of professional qualifications and expert knowledge (Art. 37(5) GDPR — the provision does not require legal training), conclude a mandate contract, document the designation in writing, inform the competent supervisory authority informally (which one that is appears at the end of the section Where the savings end), add the contact details to the privacy notice on the website (Art. 13 GDPR, see the table of obligations), inform employees. As a practical recommendation on expert knowledge: measure it against the scope and risk of your own processing activities and file the basis of the selection — evidence, references, experience with comparable processing — together with the designation, dated. Limit: the tasks under Art. 39(1)(a)–(e) GDPR remain identical — informing and advising, monitoring compliance including awareness-raising and training of the staff involved, advising on the data protection impact assessment, cooperating with the supervisory authority and acting as its contact point. For an internally employed data protection officer there is one more point: the protection against dismissal in § 6(4) BDSG applies to non-public bodies via § 38(2) BDSG and only where the designation is mandatory; in Austria § 6(4) BDSG does not apply, and the prohibition on dismissal from the role and on any disadvantage under Art. 38(3) GDPR applies directly. As a practical note on the staffing decision: the risk of conflict is high with internal staffing as soon as the function is combined with a dual role — with the head of IT, for example — and low with an external mandate; the question of roles should therefore be clarified and documented before the designation.

Sources: Art. 37(1) GDPR § 38(1) BDSG (DE) Art. 37(5) GDPR Art. 39(1) GDPR § 6(4) BDSG (DE) Art. 38(3) GDPR

2. Templates instead of individual advice

Templates save the time needed to draft, not the substantive decision. The fee for a lawyer drafting a data processing agreement or a data protection impact assessment from scratch depends on scope and complexity and is to be clarified via quotes; our complete template set for GDPR documentation costs a one-off EUR 990 net, 12 months of legal-status updates included. You arrive at your own figure from the number of data processing agreements and impact assessments arising each year times the fee quoted per document, set against the one-off price of the set.

A template holds up where the law prescribes the structure. For the record of processing activities, these are nine fields per processing activity: eight from the seven mandatory items in Art. 30(1)(a)–(g) — point (c) bundles two items — plus the legal basis as a ninth field, which is not in Art. 30(1) but follows from the accountability principle in Art. 5(2) GDPR:

1. Name and contact details of the controller and, where applicable, of the data protection officer
2. Purposes of the processing
3. Description of the categories of data subjects
4. Description of the categories of personal data
5. Categories of recipients
6. Third country transfers together with safeguards
7. Envisaged time limits for erasure
8. General description of the technical and organisational measures (reference to the TOM concept under Art. 32 GDPR)
9. Legal basis — a practical field derived from Art. 5(2) GDPR, for example Art. 6(1)(b) for a contract or (f) for legitimate interests

A separate, shorter catalogue with four mandatory items under Art. 30(2)(a)–(d) applies to data processors:

1. Name and contact details of the data processor and of each controller on whose behalf it acts and, where applicable, of the representative and of the data protection officer
2. Categories of processing carried out on behalf of each controller
3. Where applicable, third country transfers including documentation of suitable safeguards
4. Where possible, a general description of the technical and organisational measures under Art. 32(1) GDPR

The minimum content of the data processing agreement (Art. 28(3) GDPR) can likewise be pre-structured.

Step: adopt the template, fill in the fields for each processing activity, do not copy the technical and organisational measures into every record but refer to them centrally, and record the version status with a date. Limit: the data protection impact assessment is not a form-filling exercise — it is the assessment of the impact which the controller carries out in advance where the risk is likely to be high (Art. 35(1) GDPR; the three standard cases in Art. 35(3) GDPR are named in the table of obligations below). The data protection officer advises on it (Art. 39(1)(c) GDPR); the assessment itself remains with the controller.

Sources: Art. 30(1) and (2) GDPR Art. 28(3) GDPR Art. 35(1) GDPR Art. 5(2) GDPR

3. Cookieless analytics instead of cookie-banner tools

A method that stores nothing in the terminal equipment and reads nothing from it saves the consent banner, not the legal basis. The consent requirement in § 25(1) of the German Telecommunications-Digital-Services Data Protection Act (TDDDG) attaches to precisely this technical operation: the storage of information in the end user's terminal equipment or access to information already stored there. Whether a specific product neither stores nor accesses is a question of fact that you should have the provider confirm in writing. Providers of cookieless analytics such as Pirsch advertise that they work without a banner; with consent management tools such as Cookiebot or Usercentrics, the banner configuration also has to be set up and maintained on an ongoing basis — in practice that means categorising all cookies and scripts that are set, updating the categories whenever the website or a tool changes, and retesting the banner after every change — plus evidence of consents and their withdrawal (see the limit). If the situation covered by § 25(1) TDDDG does not arise, the banner falls away and with it its configuration and maintenance effort; that is where the saving lies, not in a comparison of the monthly fees. You arrive at your own figure from the number of website and tool changes per year times the effort for each round of maintenance and testing.

Storage or access without consent is permitted under § 25(2) TDDDG only where the sole purpose is to carry out the transmission of a message, or where access is strictly necessary in order to provide a digital service expressly requested by the user. In Austria, § 165 of the Austrian Telecommunications Act 2021 (TKG 2021) governs the opt-in for tracking cookies.

Step: have the provider document whether information is stored on or read from the terminal equipment; add web analytics to the record as a separate processing activity. As a practical recommendation before sign-off: check in the browser whether entries appear in cookies, localStorage or sessionStorage after the page is called up, and file the result, dated, together with the provider's confirmation; for the banner side there is the Cookie Banner Audit (a review of the banner against the TDDDG and the GDPR). What follow-up work a change of tool triggers after that is set out in Tip 4. Limit: the legal basis under Art. 6(1) GDPR remains untouched (table of obligations). Where consent continues to be used, the controller must be able to demonstrate that consent was given (Art. 7(1) GDPR), and withdrawal must be as easy as giving consent (Art. 7(3) GDPR).

Sources: § 25(1) and (2) TDDDG (DE) § 165 TKG 2021 (AT) Art. 6(1) GDPR Art. 7(1) and (3) GDPR

4. EU providers instead of US providers

An EU provider only saves the third country documentation in so far as no transfer to a third country actually takes place — the contractual and record-keeping obligations do not fall away in any event. The assessment effort for the third country safeguard attaches to recipients in third countries; without a third country transfer it does not arise. For each recipient in a third country it consists in selecting and assessing the safeguard instrument, documenting the safeguard, keeping it in a dedicated column of the record and updating it whenever the provider changes. You arrive at your own figure from the number of third country providers thereby avoided times the effort per assessment — internal working time or an advisory fee as quoted.

The reason for the effort lies in the record: every processing activity includes the categories of recipients and — where applicable — third country transfers together with documentation of suitable safeguards (Art. 30(1) GDPR). Recipients in third countries require a safeguard (standard contractual clauses, the Data Privacy Framework, binding corporate rules), which is kept in a dedicated column; EU recipients are in practice listed by name. Where a recipient in a third country is unavoidable, the safeguard, the documentation and the entry in the record remain — changing provider only saves where it avoids the third country transfer entirely. One typical audit finding is the missing third country notice for US tools such as Mailchimp, Google or Zoom; a second is an outdated list of recipients in which decommissioned tools have been left standing.

Step: update the list of recipients for each processing activity, check for each recipient whether a third country transfer takes place, and document the safeguard in the column provided for it. As a practical recommendation for this check: ask the provider for the current list of sub-processors with their locations and for written confirmation as to whether support or administration access occurs outside the EU. As long as either point is open, it cannot be demonstrated that no third country transfer takes place; an EU company seat alone does not demonstrate this. Examples of such switches are Brevo instead of Mailchimp and Hetzner instead of AWS. Follow-up work arises after the switch; as a practical recommendation for it: terminate the data processing agreement with the previous provider and file it with a date; in doing so, require the erasure or return of the data at the controller's choice (Art. 28(3)(g) GDPR) and document the confirmation; adapt the privacy notice to the new recipient and, where a tool has changed, to the new analytics method (Art. 13 GDPR, see the table of obligations); update the existing entry in the record instead of creating a second one, with a version status and a date. Limit: changing provider changes nothing about the data processing agreement under Art. 28(3) GDPR and nothing about the selection assessment under Art. 28(1) GDPR — both are set out in full in Tip 6. An EU provider, too, is a recipient that belongs in the record.

Sources: Art. 30(1) GDPR Art. 28(1) and (3) GDPR

5. GDPR self-check with existing on-board resources

A self-check shows gaps, but replaces none of the evidence a supervisory authority asks for. The on-board resources on this site can be used without additional advice: the GDPR checklist with 30 check points, the GDPR Self-Assessment and the tools described in the companion article 8 free entry-level tools. The three differ in their scope: the checklist covers the breadth, the self-assessment delivers a maturity score with a roadmap of measures, and the companion article describes the individual tools; as a practical recommendation, check the breadth first and then determine the maturity level. The effort for the four check steps below depends on the number of processing activities — as an empirical value, 14 typical processing activities are a realistic starting point for an SME:

1. Payroll
2. Applicant management
3. Newsletter distribution
4. CRM customer master data
5. Web analytics
6. Video surveillance
7. Customer communication
8. Processing on behalf of a controller
9. Supplier management
10. Complaints management
11. Sickness cases and occupational reintegration management
12. Time recording
13. Vehicle fleet with GPS tracking
14. Inventory of work equipment, in so far as it is personal data

As a practical recommendation for planning: schedule a separate session for each processing activity — with 14 entries, the run-through is not a single meeting but a project with an owner and an end date.

The self-check becomes useful when it follows the order in which the checks are made:

1. Record of processing activities — completeness, currency and plausibility
2. Data processing agreements — is every external data processor named in the record also covered contractually?
3. TOM concept — does it cover the requirements of Art. 32(1) GDPR (the official wording is authoritative, linked in the sources block at the end of this article) and are the measures assigned to the processing operations with the highest risk?
4. Data protection impact assessments — carried out for the high-risk processing operations? The three standard cases are named in the table of obligations.

If the record is incomplete, stop the run-through at this point — steps 2 to 4 presuppose it.

Step: work through the self-check in this order, record each gap with an owner and a deadline, and file the result with a date — the accountability principle in Art. 5(2) GDPR requires evidence of compliance, not a score. As a practical recommendation on responsibility and frequency: assign the run-through to a named person from management or the compliance function, have the result commented on by the data protection officer — informing, advising and monitoring compliance are his or her tasks under Art. 39(1) GDPR — and repeat the run-through annually and whenever something changes, quarterly in fast-growing companies. Limit: the record must be made available to the supervisory authority "on request" (Art. 30(4) GDPR); the provision does not state a deadline in days. That supervisory authorities expect it to be provided promptly is a practical observation and not a statutory deadline — so keep the record up to date enough to be handed over without rework. A statutory deadline does apply to data subject requests, however: without undue delay and in any event within one month, extendable by two further months (Art. 12(3) GDPR). Tip 5 does not directly reduce any invoice — it prepares the legal assessment, because the record, the comparison of data processing agreements and the list of gaps are already available in structured form when the mandate begins (row 5 of the cost comparison).

Sources: Art. 5(2) GDPR Art. 30(4) GDPR Art. 12(3) GDPR

6. Standard data processing agreement instead of individual negotiation

A standard data processing agreement holds up if it fully covers the statutory minimum content. SaaS standard agreements are often sufficient in practice; what is then avoided is the legal review and renegotiation of a standard agreement already submitted, per provider — not drafting a new one, which is covered in Tip 2. You arrive at your own figure from the number of providers times the fee quoted per review.

Art. 28(3) GDPR requires a contract or another legal act. Six stipulations are already named in the opening sentence of the provision:

1. Subject matter of the processing
2. Duration of the processing
3. Nature and purpose of the processing
4. Type of personal data
5. Categories of data subjects
6. Obligations and rights of the controller

These six stipulations describe the processing as well as the obligations and rights of the controller — the obligations of the data processor itself are not among them. Those obligations are in Art. 28(3)(a)–(h) GDPR; the contract must in any event impose these eight points on the data processor:

1. Processing only on documented instructions from the controller, including for a third country transfer (point (a))
2. Confidentiality of the persons authorised to process the data (point (b))
3. All measures under Art. 32 GDPR (point (c))
4. Compliance with the conditions in Art. 28(2) and (4) GDPR for engaging further data processors (point (d))
5. Assistance to the controller with data subject rights under Chapter III (point (e))
6. Assistance with the obligations under Art. 32 to 36 GDPR (point (f))
7. After the end of the services, erasure or return of all data at the controller's choice and erasure of existing copies, subject to statutory storage obligations (point (g))
8. Making available all information needed to demonstrate compliance and allowing for and contributing to audits, including inspections (point (h))

Look for these eight points individually in the draft submitted to you: if one is missing or watered down — for instance erasure or return as an option for the provider rather than the controller (point (g)), or an evidence clause that excludes audits including inspections (point (h)) — that is a point for renegotiation. Whether an existing clause is sufficient in the individual case remains a question of interpretation; the official wording of Art. 28(3) GDPR is authoritative, linked in the sources block at the end of this article. Irrespective of the contract text, Art. 28(1) GDPR applies: the controller shall use only data processors providing sufficient guarantees to implement appropriate technical and organisational measures — no template takes this selection assessment off your hands.

Step: compare the draft point by point against the six stipulations and the eight obligations above, note any missing or watered-down points, and link each data processor to the matching entry in the record. Limit: two mix-ups are expensive. First the question of roles: processing on behalf of a controller (Art. 4 no. 8 GDPR) is something different from joint controllership (Art. 26 GDPR) — get the classification wrong and you have the wrong type of contract. Second the question of documents: the data processing agreement is not the record. Data processors additionally keep their own record with four mandatory items under Art. 30(2) GDPR.

Sources: Art. 28(1) and (3) GDPR Art. 26 GDPR Art. 30(2) GDPR

Cost comparison at a glance

For each measure, the table names the standard route, the low-cost route and the limit of the saving. Not every row is about two ways of fulfilling the same obligation: in row 3 the low-cost route means the situation covered by § 25(1) TDDDG does not arise, provided that the method neither stores in nor reads from the terminal equipment (see Tip 3); in row 4 the third country constellation does not arise; and row 5 does not compare the fulfilment of an obligation at all.

The rows have different frames of reference and therefore cannot be added up into a total.

Where the savings end: obligations with no low-cost option

All six tips reduce spending within a framework that they do not shift. Whether one of the following obligations applies depends solely on the statutory trigger in the middle column — the choice of tool, provider and mandate changes the cost of compliance, not the substance of the obligation. Some triggers depend on the technical or contractual constellation: consent under § 25(1) TDDDG presupposes that something is stored in or read from the terminal equipment at all (see Tip 3); the data processing agreement and the data processor's own record presuppose processing on behalf of a controller. For each row, the table names the obligation, the statutory trigger and the legal source. Purely national provisions are marked "DE" or "AT"; all other sources are GDPR provisions, which apply directly in Germany and Austria alike.

In Germany, supervision of non-public bodies is in principle a matter for the Land authority competent under state law (§ 40(1) BDSG) — there is no single federal authority for this; for federal public bodies and for certain providers of telecommunications services, the Federal Commissioner for Data Protection (BfDI) is competent (§ 9(1) BDSG). In Austria it is the same body for all controllers: the Austrian Data Protection Authority (Datenschutzbehörde), seated in Vienna (§ 18(1) DSG).