What does an external data protection adviser cost?
Updated: 2026-10
The cost of external data protection support depends less on company size than on data types, applicable law, the number of systems and processors, the volume of requests and incidents and the state of documentation. Common is a set-up phase with fixed scope followed by ongoing support with a clearly defined scope.
Whether a company needs external data protection support, and what it costs, cannot be answered in general. In Switzerland appointing a data protection adviser is voluntary for private companies, under the GDPR a data protection officer may be mandatory, and in Germany the 20-person rule applies in addition. The legal starting point determines the scope.
The biggest influence on cost, however, is the starting state: a company with a current record of processing, settled contracts and rehearsed processes needs little ongoing support. One without these foundations needs a set-up phase first.
What drives the cost
Data types
Processing sensitive data — health, criminal proceedings, private individuals’ finances — requires more clarification, more frequent impact assessments and stricter measures than a company with business contacts only.
Applicable law
Only the FADP or the GDPR as well, possibly with a duty to appoint a DPO or EU representative: each additional legal system extends documentation, reporting routes and information duties.
Systems and processors
Every tool with personal data needs classification, a contract and possibly a check of disclosure abroad. Many tools with third-country links raise the effort considerably.
Requests and incidents
Access requests, deletion requests and data breaches cause ongoing effort. Companies with many end customers typically see more requests than pure B2B providers.
Internal contact
An internal person who coordinates and supplies information considerably reduces external effort. Without one, the external adviser must gather much of it themselves.
State of documentation
If the record of processing, TOM description or current contracts are missing, set-up effort arises before ongoing support can become lean.
How we price
- 01
Fixed-scope set-up
Inventory, record of processing, contracts, privacy notice and processes for requests and incidents as a closed project at a price agreed in advance.
- 02
Ongoing support
A monthly framework with a defined scope, such as advice on new tools, contract reviews, support with requests and an annual review.
- 03
As needed
For companies with good foundations and little change: support on concrete questions, billed by effort.
We deliberately publish no online prices: every case differs. After a short first conversation you receive a binding fixed price or clear frame.
Parent service: Data Protection Consulting
Matching offers
revFADP implementation for SMEs: from status quo to evidence
A bounded package that takes a Swiss SME from uncertainty to a documented state: capture data flows and providers, determine obligations, review contracts and international transfers, provide privacy-policy groundwork and set clear procedures for data breaches and access requests.
Data breach readiness: playbook, notification process and drill
Data breach readiness gives you a ready-to-use playbook: named roles and emergency contacts, a decision matrix per system for notification duties under the FADP and GDPR, templates for authorities, data subjects and customers, an incident register and a guided drill. In an emergency you decide in minutes instead of hours.
FAQ
Do Swiss SMEs need a data protection adviser at all?
Private companies have no obligation under the FADP. It makes sense with sensitive data, many tools or an EU nexus. An appointed adviser can also replace consulting the FDPIC on impact assessments with high residual risk.
Why do you not state a flat fee?
Because the same price would be too high for a company with clean foundations and too low for one without documentation. A short initial conversation clarifies the starting point and yields a binding range.
Can an internal person take on the role?
Yes, if they have the expertise, time and independence and no conflicts of interest. A combination of internal coordination and external advice is often the most economical.