Kenya enacted a data protection law in 2019, and all people processing personal data are now expected to handle such data in a manner that promotes the privacy and other rights of the people the data is about. This manual gives a simplified analysis through which small organisations can assess their data handling practices. It gives a six step process through which organisations can undertake a systematic analysis of data processing activities to help identify and mitigate risks to people affected by data processing activities.