toolbox
Home / Legal, Safety & Compliance / CCPA Compliance Audit Sample Size Estimator

CCPA Compliance Audit Sample Size Estimator

The CCPA Compliance Audit Sample Size Estimator calculates a statistically based sample for reviewing a finite population of privacy records, cases, or control instances. It can support internal testing plans when checking whether CCPA-related procedures are being followed consistently across a larger body of work.

Enter the population size, desired confidence level, margin of error, and an expected exception proportion. The result uses the standard proportion sample-size formula with a finite population correction. It is not a sample size mandated by the CCPA, and statistical sampling does not replace targeted review of high-risk cases, known exceptions, or legally significant records. Use it as one input to an audit plan alongside professional judgment and the purpose of the test.

Calculator inputs

records
%
%
%
Result
—
Recommended statistical sample
Recommended sample—
Population—
Confidence level—
Margin of error—

1. Define the population

Enter the total number of records or cases that belong to the audit population.

2. Choose confidence

Enter the statistical confidence level you want for estimating a population proportion.

3. Set precision

Enter the acceptable margin of error in percentage points.

4. Estimate the expected rate

Enter the expected proportion for the characteristic or exception being measured. Use 50% when you need a conservative sample and have no useful prior estimate.

5. Use the result in an audit plan

Round up to the displayed sample and select records using a defensible method appropriate to the audit objective.

Initial sample n₀ = z² × p × (1 − p) ÷ e²; Finite sample n = n₀ ÷ (1 + (n₀ − 1) ÷ N)

Where:

  • z: standard-normal value corresponding to the entered confidence level
  • p: expected proportion expressed as a decimal
  • e: margin of error expressed as a decimal
  • N: finite population size
  • n: recommended sample size, rounded up

Assumptions: The model estimates a simple random sample for a population proportion. It assumes independent observations and does not account for clustering, stratification, risk-weighted selection, or a regulatory mandate.

What the result means

The result is the rounded-up number of records for a simple random sample under the entered statistical assumptions.

Sampling design should reflect the audit objective and risk profile; this tool does not establish a legal or regulatory requirement.

Given:

  • Population: 5,000 records
  • Confidence: 95%
  • Margin of error: 5%
  • Expected exception rate: 10%

Calculation:

At 95% confidence, z ≈ 1.960

n₀ = 1.960² × 0.10 × 0.90 ÷ 0.05² ≈ 138.3

n = 138.3 ÷ (1 + 137.3 ÷ 5,000) ≈ 134.6

Round up to 135 records

Result: Recommended statistical sample: 135 records.

Interpretation: The sample is sized to estimate a 10% proportion within about ±5 percentage points at 95% confidence under the model assumptions.

Does the CCPA specify this statistical sample size?

No. The calculator uses a general statistical formula and does not represent a CCPA-mandated audit sample.

Why does 50% produce a larger sample?

For a proportion estimate, p = 50% maximizes p × (1 − p). That makes it a conservative choice when the expected rate is unknown.

Can I sample only the highest-risk records?

You can perform targeted testing, but a risk-selected sample is not the same as a simple random statistical sample. Document the selection method and do not interpret targeted results as if they were random-sample estimates.

What happens with a very small population?

The finite population correction reduces the required sample as the population becomes smaller. The calculator also caps the sample at the total population.

Should I increase the sample when exceptions are found?

Often an audit team may expand testing after finding exceptions, but the appropriate response depends on the audit objective, control design, and risk. This calculator does not prescribe escalation rules.