TL;DR
Most companies treat governance as overhead to minimize, and that framing is the reason it decays: the spend leaves nothing durable behind. Built as a system, it becomes a capability whose cost amortizes, and two engagements at opposite ends of the scale carry the proof. The honest claim is amortized cost, not zero cost.
The prevailing practice: compliance as a cost center
The default way to handle the General Data Protection Regulation (GDPR) and consent work is to treat it as overhead: budget the minimum, buy the cheapest tool, staff it thinly, and check the deadline off once. The vocabulary is common ground: a cost center, a compliance budget, a consent manager. What stays unspoken is the assumption underneath, that governance is a tax the business pays to stay out of trouble, and will keep paying forever. That is what governance under constraint exists to answer.
Where it breaks
The checkbox version satisfies nobody when the control body finally shows up, because the money spent leaves nothing durable behind. I have watched it fail twice, at two very different scales.
- On a single product, a **free consent manager chosen in 2018** stopped meeting the latest requirements of the French data-protection authority (CNIL), on a site the French control bodies inspected regularly. The gap would have been held against the company, and the cheapest option had carried no guarantee.
- Inside a group of about two hundred people, the parent’s reinforced GDPR standard landed on an organization far from ready, carrying a documentation load nobody had ever done: thirty interlocutors, a fixed deadline, three people.
Why it breaks
The mistake is structural, not financial. Governance gets treated as a one-time obligation to discharge, a document to file, rather than a system to build and keep running. Budgeted as a tax, nobody invests in it, so it decays. Requirements move: the CNIL’s rules tighten, and a tool bought once and left alone does not follow them. The cheapest choice carried no guarantee, so when the requirement moved, the saving became the exposure. What the cost-center framing hides is that a line item and a capability are not the same purchase.
What it costs at scale
The bill is the visible part. The larger cost is the work nobody scoped:
- Repeated remediation cycles, each staffed by pulling people off planned work.
- Real exposure under a control, because the gap was deferred, never closed.
- Mental load spread across the organization, as teams redo what a durable process would have done once.
I have carried both forms: a security policy never written and drafted from scratch under deadline, and a market-leading site already a regular control target forced into a full rebuild nobody had budgeted for. Neither was a line on a bill; both were work a cost-center stance guaranteed would arrive unplanned.
The alternative: engineering governance to keep working
What I do instead is treat the mandate as a system with a lifecycle: run it on a real method, document once so the work outlives the engagement, design for maintainability so the setup survives its maker, and reuse it for the next control.
- On the single product, delivered as an engineering task, it left behind a maintenance setup designed to run without me and a filmed handover. A real CNIL control six months after deployment raised no requirements or problems.
- On the group rollout, a three-person team met the parent’s reinforced standard on time. The documentation and the working group outlived the deadline, and the budget the data protection officer (DPO) received was earned.
Both share one cause: the up-front investment in method, documentation, and maintainability is what keeps governance from becoming a recurring, unplanned cost. That is the discipline behind systems that scale, a system that keeps working after its builder steps away.
The objection: amortized cost, not zero cost
Governance work is genuinely slower, and it is not free up front; this is not a zero-cost reframe. The honest claim is amortized cost: you pay more at the start, and the investment returns through fewer remediation cycles, through surviving a real control with nothing raised against you, and through systems that stay usable. The documentation the group kept using and the control that passed were work done once and maintained. The capability behind it is part of who I am: I come in on a mandate under constraint and leave the operation able to run it without me.
If you carry a governance budget and worry it will only ever be a cost center, let’s talk. Bring the constraint you are working under.