10 Data Privacy Tips for Protecting Your Personal Information Online

Your email address, your phone number, your home address, the name of your dog, and the fact that you were on holiday in Portugal last August are probably scattered across forty different databases right now. Some of them you handed over willingly. Some you never knew existed. And a few are sitting on a server somewhere, waiting for the right breach to spill them into a marketplace where they'll be sold for less than the price of a coffee.

I know the feeling, because I've been on the wrong end of it. A few years ago, a retailer I'd bought from had a breach. I found out six weeks later, from a friend who'd seen my name in a paste dump posted on a forum. Not from the company. From a friend. That's the state of things.

So here's what I actually do now, and what I'd tell you to do if we were sitting across a table. These are data privacy tips that hold up in practice, not theory, and they'll help you protect your personal information online without turning your life into a full-time security job.

How to protect personal information online: the basics that actually matter

Most advice on this topic is a list of things you should care about but never will. I'm going to skip the moralising and focus on the handful of moves that produce the biggest reduction in risk.

Passwords: the boring foundation

A password manager is non-negotiable in 2026. I don't care which one you pick — Bitwarden, 1Password, Proton Pass, whatever fits your budget. What matters is that you stop reusing the same three passwords across every site you visit. When one site gets breached (and it will), attackers immediately try that same email and password combination on Gmail, banking portals, and social media. This is called credential stuffing, and it works because people reuse passwords.

My rule: every account gets a unique password of at least 16 characters, and I only remember the master password. I'll be honest — the first month felt annoying. By the second month I couldn't imagine going back.

Two-factor authentication, done properly

Not all 2FA is equal. SMS codes are better than nothing, but they're vulnerable to SIM-swapping, where someone convinces your carrier to move your number to their SIM. I've seen this happen to a colleague who lost access to his bank account for nine days while the mess was sorted out.

If a service offers it, use:

• An authenticator app (Authy, Aegis, Google Authenticator)
• A hardware security key like a YubiKey for your email and banking
• Passkeys, where supported — they're phishing-resistant by design
• SMS codes only as a last resort, never as your primary factor for critical accounts

Protecting your personal information on social media

Here's a number that should stop you cold: roughly a third of identity theft cases I've read about in consumer-protection forums start with information someone volunteered publicly. Your birthday. Your mother's maiden name. The street you grew up on. All classic security-question answers, all sitting on your Facebook timeline.

What I do now, and what I'd suggest you do:

1. Set your profile to "friends only" and audit that friends list at least twice a year.
2. Remove your birth date, phone number, and hometown from public view.
3. Never post vacation photos while you're still away — it advertises an empty house.
4. Turn off geotagging on your camera app.
5. Assume anything you post is permanent and screenshot-able. Because it is.

Internet never forgets. That photo of your passport you posted for a "fun travel memory" in 2019 is still searchable today.

How to secure my Gmail account from hackers

Your email is the master key to your digital life. Whoever controls it can reset the password on almost everything else you own. So it deserves the strictest protection you can give it.

A practical Gmail hardening checklist

• Use a long, unique password stored in your manager.
• Enable 2-Step Verification with Google's Authenticator app or a passkey.
• Register a recovery phone and email you actually control — and check them for unauthorised changes.
• Review "Recent security activity" in your Google account settings once a month.
• Check connected third-party apps and revoke anything you don't recognise.
• Set up Google's Advanced Protection Program if you're a journalist, activist, or just paranoid (I am).

I check my security activity on the first of every month, same as paying rent. It takes four minutes. I once caught a login attempt from a country I'd never visited — turned out to be an old device I'd forgotten about, but the habit is what matters.

Protecting personal information in the workplace

This one gets less attention than it should. Your employer holds a huge amount of your data — tax records, health insurance details, performance reviews, salary. And you hold theirs. Both sides have an interest in keeping it locked down.

What you can control:

• Never use your work email for personal sign-ups or shopping accounts.
• Keep work and personal devices separate, or at least separate user profiles.
• Don't plug unknown USB drives into your work laptop. Ever.
• Use your employer's VPN on public Wi-Fi, not a random free one.
• Report suspicious emails to IT rather than clicking "just to check".

And why should your organisation care? Because a single compromised employee account can expose client data, trigger regulatory fines under GDPR or CCPA, and cost the business more than any single productivity gain. Privacy at work isn't just a personal matter — it's a shared liability.

How should you respond to this email to protect your digital security?

If you receive an email asking you to click a link, verify your account, confirm a payment, or "urgently" update your details — stop. Don't click. Don't reply. Don't forward it to friends.

Here's the practical routine I follow:

The cost of one careless click is much higher than the cost of ten seconds of suspicion.

What to do after a data breach

This is where most articles fall silent, and it's the part that matters most. If your data has been exposed, you have a tight window to limit the damage.

The steps I'd take — and did take

1. Change the password on the breached account, and anywhere you reused it.
2. Enable two-factor authentication on every account that touches money or identity.
3. Freeze your credit file with the major bureaus. It's free, and it stops new accounts being opened in your name.
4. Set up fraud alerts with your bank and monitor statements weekly for the next three months.
5. Report the breach to the relevant data protection authority if the company hasn't done so.
6. Consider an identity monitoring service for the following 12 months — not because it prevents anything, but because it catches things early.

After my own breach, I froze my credit the same week. Two months later, a fraudulent credit application was blocked automatically. That single action paid for itself in avoided stress.

Your legal rights over your data

In the EU and UK, GDPR gives you the right to access, correct, delete, and port your data. In California, CCPA/CPRA grants similar powers. Most people never exercise them, which is a shame, because companies have 30 days to comply or explain why they won't.

Right	What it means in practice	Where to send the request
Access	Get a copy of all data a company holds on you	The company's privacy or DPO email
Deletion	Demand they erase your data (with legal exceptions)	Same contact, in writing
Rectification	Fix inaccurate information about you	Company privacy team
Objection	Stop certain processing, like marketing profiling	Privacy settings or DPO
Complaint	Escalate to your national data authority	Regulator's online form

I once sent an access request to a marketing company that had my email. They took 28 days to respond and politely removed me from their list. Worth the ten minutes it took to write.

One habit that beats every tip on this list

If I had to reduce all of this to a single habit, it would be this: slow down when you're asked to hand something over. A new app, a "free" trial, a quiz that needs your birth date, a form asking for your ID "just to verify". Every one of those is a data point someone can sell or lose.

Privacy isn't about disappearing. It's about deciding, deliberately, who gets to know what about you. The tools help. The habits protect. And the day you notice you haven't thought about it in months — that's the day it's working.