GDPR - Art. 12-15
GDPR DSR Cost Calculator
Cost out your data subject request workload and check the response deadlines that apply.
How this is calculated
- Effective minutes per request = average minutes x (1 + 2 x share of complex requests). That assumes a complex request takes three times as long as an average one; the share is capped at 100%.
- Staff hours per month = requests x effective minutes / 60. Monthly cost = hours x hourly cost; annual cost = monthly cost x 12.
- Colour: monthly cost above EUR 5,000 is red, above EUR 1,000 amber, otherwise green.
- The deadline and fee rules shown with the result come straight from GDPR Art 12 and 15; they do not change the cost figure.
Constants the tool uses
Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.
- Complex request handling time
- 3x the average
- Colour thresholds (monthly cost)
- Amber above EUR 1,000, red above EUR 5,000
Worked example
The calculator run on its default inputs:
- Data subject requests per month
- 20 requests
- Average handling time per request (minutes)
- 45 min
- Fully-loaded hourly cost of handling staff
- €40
- Share of complex requests (%)
- 15%
€780 per month handling DSRs
€9,360/yr
- Requests per month
- 20
- Effective handling time per request
- 59 min (complex ≈3×)
- Staff hours per month
- 19.5
- Monthly cost
- €780
- Annual cost
- €9,360
Twenty requests a month at 45 minutes, with 15% complex, gives 45 x (1 + 2 x 0.15) = 58.5 effective minutes (shown rounded as 59). That is 19.5 staff hours a month; at EUR 40 an hour, EUR 780 a month or EUR 9,360 a year.
Sources
- GDPR Art. 12 and 15 - Regulation (EU) 2016/679 (EUR-Lex) - one-month deadline extendable by two months (Art 12(3)), free of charge and the manifestly unfounded or excessive exception (Art 12(5)), identity checks (Art 12(6)), fees only for further copies (Art 15(3))
Sources last checked September 2026.
Limitations
The figure covers handling time only - not tooling, legal review, or the extra effort of searching systems that are hard to query. The statutory deadlines apply however the cost comes out. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.