How to Protect Your Personal Data Online

In short: To protect your personal data online, the UK's National Cyber Security Centre calls turning on two-step verification "the first – and most important – step" for protecting your accounts, and recommends passkeys as your first choice of login where they're offered. Pair that with a password manager for unique passwords, automatic software updates, and — for US readers — a free credit freeze with the three credit bureaus, per the Federal Trade Commission.

A breach notice tells you your data was exposed. It doesn't tell you what to do about it. The habits below come from national cyber security agencies and consumer regulators in the UK and US, in the order those agencies themselves emphasize them. Each one explains why it helps and how to set it up.

What are the most effective ways to protect personal data online?

NCSC is explicit about where to start: "The first – and most important – step is to turn on two-step verification (2SV) to help protect you if your password gets phished or otherwise compromised," according to NCSC's guidance on password managers. Where a service offers a passkey instead of a password, NCSC recommends using it as your first choice of login. Behind that, a password manager with unique passwords, automatic updates, and — in the US — a credit freeze round out the set of habits government agencies point to most consistently.

Why is two-factor authentication better than SMS?

Two-factor authentication (2FA, also called MFA) stops an attacker even when they already have your stolen password, because they still need a second factor they don't possess. The US Cybersecurity and Infrastructure Security Agency (CISA) puts the odds in concrete terms: "The use of MFA on your accounts makes you 99% less likely to be hacked," according to CISA's guidance on multifactor authentication. The mechanism is simple — "even if one credential becomes compromised, unauthorized users will be unable to meet the second authentication requirement," per CISA.

Not all 2FA resists attack equally. SMS codes and basic push notifications can be captured by a fake login page along with your password. CISA "urges all organizations to start planning a move to FIDO because when a malicious cyber actor tricks a user into logging into a fake website, the FIDO protocol will block the attempt," according to CISA's guidance on MFA. FIDO is the technology behind passkeys — see our guide on how passkeys work for how to turn one on.

Where passkeys aren't available, CISA's fallback is an authenticator app rather than a text message: "If you can't currently implement phishing-resistant MFA, consider using numbers matching MFA to block mobile push bombardment and SMS-based attacks," per CISA. In practice: turn on a passkey where offered, use an authenticator app where passkeys aren't available, and treat SMS codes as a last resort.

How does a password manager protect my data after a breach?

A password manager stores every password so you don't have to remember them, which removes the main reason people reuse one password across accounts. NCSC warns why that reuse is dangerous: "if you use the same password across different accounts and one of your accounts is compromised, a hacker can try the same password on your other accounts and potentially gain access to them too," according to NCSC.

A manager fixes this by generating and remembering unique passwords for you. NCSC explains: "A password manager stores passwords safely for you, meaning that you can have unique passwords for each service as you won't need to remember them," per NCSC. Good managers also autofill logins — which helps block phishing sites that don't match the saved address — sync across devices, and flag passwords that have shown up in a known breach.

To get started, install a password manager, let it import your existing logins, and turn on autofill. For any account that doesn't yet offer a passkey, NCSC's advice is to keep using "a strong and unique password and two-step verification (2SV)," per NCSC, which is why this habit pairs directly with the 2FA step above.

What's the fastest way to implement data protection habits?

Updates are the quickest win on this list. NCSC calls applying them "one of the most important (and quickest) things you can do to keep yourself safe online," according to NCSC's guidance on software updates. The agency recommends turning on "automatic updates" in your device's settings, noting "this will mean you do not have to remember to apply updates," and suggests doing the install itself at home on reliable wi-fi with the device plugged in, since it may take some time, per NCSC.

There's a limit to how long this habit works on old hardware. NCSC warns that once a phone stops receiving manufacturer updates, "it won't receive the security updates from the manufacturer (and without these your phone is less secure)," and advises against buying or keeping phones that are no longer supported, per NCSC. You don't need the newest or most expensive device, just one still getting security patches.

Should I freeze my credit after a breach? (US readers)

A credit freeze restricts who can see your credit file, which makes it harder for an identity thief to open a new account using data stolen in a breach. The Federal Trade Commission notes that "starting September 21, 2018, you can freeze and unfreeze your credit file for free," per the FTC. The mechanism runs through the US credit reporting system, so the FTC advice below applies to US consumers; readers elsewhere should check what their own national credit reference agencies offer.

To freeze your credit, the FTC says to "contact all three of the nationwide credit reporting agencies – Equifax, Experian, and TransUnion." A freeze requested online or by phone must be placed within one business day, and lifting it — say, when you apply for a loan — must happen within one hour of your request, per the FTC. A freeze doesn't touch your credit score, and it doesn't stop you using cards you already have: "No, you don't have to lift a credit freeze before you use a credit card you already have," the FTC says.

If a full freeze feels like too much, the FTC describes a lighter option. "A fraud alert tells businesses that check your credit that they should check with you before opening a new account," and as of September 21, 2018, a fraud alert lasts one year instead of 90 days, and is also free, according to the FTC.

The checklist

1. Turn on two-step verification or passkeys on your important accounts first. NCSC calls this "the first – and most important – step" for protecting an account if a password leaks, per NCSC. Our guide on how passkeys work walks through setup.
2. Switch any remaining two-factor sign-in from SMS to an authenticator app. CISA recommends number-matching app-based MFA specifically to block mobile push bombardment and SMS-based attacks, per CISA.
3. Install a password manager and make every password unique. NCSC's concern is that reused passwords let one compromised account expose all the others, per NCSC.
4. Turn on automatic updates for your phone, computer and apps. A one-time settings change; NCSC calls this one of the quickest security actions available, per NCSC.
5. Retire devices that no longer get manufacturer security updates. A one-time decision when replacing hardware; NCSC warns unsupported phones stop receiving the patches that keep them secure, per NCSC.
6. US readers: freeze your credit file with Equifax, Experian and TransUnion. Free, and must be placed within one business day of your request, per the FTC; lifting it later takes up to one hour.

None of these steps require buying anything. The passkey or authenticator app, the password manager, automatic updates, and the US credit freeze are all free, and together they cover the habits that cyber security agencies and consumer regulators return to most often when a breach happens.