How I Protect My Personal Information Online

Why Personal Information Is Worth More Than People Think

Your personal information is worth more than you'd think, and not just to you. Your name, date of birth, address, and a few answers to "security questions" are often all a scammer needs to open credit in your name or talk their way past a call centre pretending to be you. Companies want it too, sometimes for good reasons and sometimes just to sell you things. I don't think you need to become paranoid about this, but I do think most people hand over far more than they realise, far more often than they need to. It's not always a single leak that causes the damage either. Scammers and data brokers piece together fragments from different places, a date of birth here, a pet's name there, a mother's maiden name from an old quiz, until they've got enough to answer your bank's security questions without ever having spoken to you.

The Information I Never Give Out Without a Reason

There's a short list of details I treat as genuinely sensitive: my date of birth, my home address, my mother's maiden name, and anything that looks like a security question answer. If a website, a caller, or a text message asks for one of these out of nowhere, I stop and ask myself why they actually need it. A genuine bank will never ask you to confirm your full password or PIN over the phone. A genuine competition doesn't need your date of birth to enter you into a prize draw. When in doubt, I give the minimum required and nothing more. I also treat my phone number the same way now, since it's become one of the easiest ways to reset a password or receive a one-time code meant for someone else. If a form doesn't explain why it needs it, I either skip that field or use a secondary number I don't mind being found.

The Data Broker Sites Nobody Warns You About

Even if you're careful about what you post, there's a whole industry built around collecting and reselling your personal details anyway. Data broker and people-search sites scrape public records, electoral rolls, and old data breaches, then package it into a profile anyone can buy for a few pounds, your address history, phone number, relatives, even a rough idea of your income. Most people have never heard of these sites until they find themselves listed on one. I check mine every few months and send removal requests where they're offered, since a five-minute form is a small price for getting your details off a site designed to be searched by strangers.

Where Most People Leak Data Without Realising

Most of the damage isn't done by a dramatic hack. It's done a little at a time, through things that feel harmless. A "which Harry Potter character are you" quiz that asks for your birthday. A loyalty card sign-up that wants your full address and phone number. An app that asks for access to your contacts, location, and photos just to let you crop an image. Social media profiles set to public, with a birthday, hometown, and school all sitting there for anyone to piece together. None of these feel dangerous on their own, which is exactly why they work. Browser extensions are another one I'd add to that list, a free tool that wants access to every page you visit is effectively reading your email and banking sessions too, whether or not it ever misuses that access.

The Habits That Actually Protect It

The habits that make the biggest difference are boring, and that's fine by me. I use a password manager so every account has a different, properly random password instead of a variation on the same one. I turn on two factor authentication everywhere it's offered, so a leaked password alone isn't enough to get in. I go through my social media privacy settings every so often and lock down anything that doesn't need to be public. And I've got into the habit of pausing before I fill in a form, just long enough to ask whether this particular website genuinely needs my date of birth to sell me a phone case. I've also started using a separate email address for sign-ups and competitions I don't fully trust, so anything that leaks stays contained to an inbox I barely check rather than the one my bank and family actually use.

What I Think Twice About Before Posting Publicly

Social media is where a lot of this information ends up handed over voluntarily, not stolen. A holiday countdown post tells the world your house is empty on a specific date. A "first day back at school" photo with the uniform badge visible can tell a stranger which school your child attends. Even a birthday post from friends in the comments can confirm a date of birth you've otherwise kept private. None of this means staying off social media, it just means asking whether a post needs to go out in real time, or whether it can wait until after the fact.

What I Do If My Information Has Already Been Exposed

If you think your details have already been caught up in a data breach, you can check services like Have I Been Pwned to see whether your email address has turned up in a known leak. If it has, change the password on that account and anywhere else you've reused it, and turn on two factor authentication if you haven't already. Keep an eye on your bank statements for anything you don't recognise, and report anything that looks like fraud to Action Fraud. My Safety Toolkit has more on locking things down properly, or you can get in touch and I'll help you work through it. It's worth doing this check periodically even if nothing feels wrong, since some breaches surface publicly months or years after they actually happened, and the first you'll hear of it is a service like this flagging your details rather than the company involved telling you directly.