What does preparing for data breaches cost?
Updated: 2026-10
The cost of preparing for data breaches depends on the number of systems with personal data, applicable legal systems and other reporting duties, the role as processor for customers, the state of documentation and the scope of the drill. A fixed-scope package plus an annual update is common.
Preparing for data breaches is one of the cheapest data protection measures relative to its benefit. It consists of roles, a decision matrix for notification duties, templates, an incident register and a drill. Effort depends on how many systems and legal systems must be covered.
Not included is forensic investigation in an emergency; that is for specialised incident response providers. Preparation defines when and how they are brought in.
What drives the cost
Systems with personal data
For each system, the data it contains and the applicable reporting routes are recorded. More systems mean a more extensive decision matrix.
Legal systems and other reporting duties
Only the FADP or the GDPR as well, plus possibly reporting duties to FINMA, the Federal Office for Cybersecurity or under DORA: each route needs templates and owners.
Processor role
SaaS providers must be able to inform their customers quickly and concretely. That requires additional templates and alignment with customer contracts.
State of documentation
A current record of processing shortens the work considerably. If missing, the inventory must be created first.
Scope of the drill
A tabletop exercise with the core team is compact; several scenarios or drills across sites increase effort.
How we price
- 01
Fixed-scope readiness package
Roles, decision matrix, templates, incident register and a guided drill at a price agreed in advance.
- 02
Annual update
Review of matrix and templates, a new drill and incorporating lessons from incidents.
- 03
Part of ongoing data protection support
For companies with ongoing data protection advice, as part of the existing framework.
We deliberately publish no online prices: every case differs. After a short first conversation you receive a binding fixed price or clear frame.
Parent service: Data Protection Consulting
Matching offers
Data breach readiness: playbook, notification process and drill
Data breach readiness gives you a ready-to-use playbook: named roles and emergency contacts, a decision matrix per system for notification duties under the FADP and GDPR, templates for authorities, data subjects and customers, an incident register and a guided drill. In an emergency you decide in minutes instead of hours.
revFADP implementation for SMEs: from status quo to evidence
A bounded package that takes a Swiss SME from uncertainty to a documented state: capture data flows and providers, determine obligations, review contracts and international transfers, provide privacy-policy groundwork and set clear procedures for data breaches and access requests.
FAQ
Is this worth it for small companies?
Yes. Small companies in particular have no time to invent processes in an emergency. A compact playbook of a few pages is often enough.
Is forensics included?
No. Technical investigation of attacks is done by specialised providers. Preparation defines who brings them in and when.
How often must the playbook be updated?
At least annually and after major changes to systems, vendors or organisation.