- Enter the population size
Count the records or items in the audit universe after defining scope and period.
- Select a confidence level
Choose the statistical confidence level used for the estimate.
- Set the margin of error
A smaller margin requires a larger sample.
- Estimate the exception proportion
Use prior audit evidence if available; 50% is conservative when the proportion is unknown.
- Review sample size and sampling rate
Round up to the displayed whole-number sample and document how records will be selected.
GDPR Compliance Audit Sample Size Estimator
This estimator calculates a statistical sample size for reviewing a finite population of GDPR compliance records, using a confidence level, margin of error, and assumed proportion requiring attention. It can support quality checks of records, notices, request files, vendor reviews, or other repeatable compliance artifacts when full-population review is impractical.
The output is a statistical planning aid, not a legal rule for how many records must be audited. Risk-based auditing may require targeted or full review for high-risk processing, known issues, small populations, or controls where a single exception is material. Use the sample size alongside audit objectives, stratification, professional judgment, and any sector-specific requirements.
Estimate GDPR audit sample size
records
%
%
Result
—
Estimated statistical sample size
Rounded sample size—
Population sampling rate—
Large-population sample—
Selected margin of error—
Formula:
n₀ = z² × p × (1 − p) ÷ e²; n = n₀ ÷ (1 + (n₀ − 1) ÷ N)Where:
- z: z-score for the selected confidence level
- p: expected exception proportion as a decimal
- e: margin of error as a decimal
- N: finite population size
- n: finite-population adjusted sample size
Assumptions: The formula estimates a sample for a proportion under simple random sampling. It does not account for clustering, stratification, weighting, nonresponse, or risk-based judgment.
What the result means
The result is a statistical sample-size estimate for the assumptions entered, rounded up to a whole record.
An audit’s legal sufficiency depends on scope, risk, methodology, and applicable requirements, not sample size alone.
Given:
- Population: 5,000 records
- Confidence level: 95% (z = 1.96)
- Margin of error: 5%
- Expected exception proportion: 50%
Calculation:
n₀ = 1.96² × 0.5 × 0.5 ÷ 0.05² = 384.16. Finite adjustment: 384.16 ÷ (1 + 383.16 ÷ 5,000) = 356.82. Round up to 357.
Result: Estimated sample size: 357 records.
Interpretation: Reviewing 357 randomly selected records provides the chosen statistical precision assumptions for estimating a proportion in a population of 5,000.
Why does 50% produce a larger sample?
For a binary proportion, variance is highest at 50%. Using 50% is therefore a conservative choice when you do not have a reliable prior estimate.
Is 95% confidence required by GDPR?
No. This calculator offers common statistical confidence levels as audit-planning choices; GDPR itself does not prescribe this sample-size formula for general compliance audits.
Should I randomly select records?
The formula assumes simple random sampling. If you deliberately target high-risk records, the sample can be useful for control testing but the statistical interpretation changes.
What if the population is smaller than the estimated sample?
The calculator caps the sample at the full population. For very small or high-risk populations, a 100% review may be more practical.
Can I use this for multiple business units?
You can, but consider stratifying by unit, process, region, or risk level so important subgroups are represented rather than relying on one pooled sample.