Keep Personal Data Safe Online: 8 Checks Every Indian Should Do

Leaked passwords, SIM cards taken in your name and Aadhaar misuse are now everyday problems in India, not rare ones. You can keep personal data safe with eight checks that take about 15 minutes in total: a long unique email password, two-step login, a free leak check, a look at mobile connections in your name, and a few Aadhaar and OTP habits.

One of these checks catches something most people never think to look for: check 6.

Why Your Personal Data Is at Risk

Most data theft doesn’t start with a hacker “breaking in” to your phone. It starts with information that’s already out there: a password reused from a site that got breached, a photocopy of your Aadhaar left at a shop, or an OTP read out to a caller pretending to be your bank.

The scale is large. Have I Been Pwned, a free breach-search site, lists over 17.8 billion breached accounts from 1,048 websites. If you’ve used the internet for a few years, your email is probably in there somewhere.

The good news: you don’t need to be a tech expert. You need a few habits, done once, and a couple of checks each year. If a bank breach is already in the news, our guide on what to do after a bank data breach claim covers the urgent steps.

Checks 1 to 3: Passwords That Keep Personal Data Safe

Long beats complicated. The UK’s National Cyber Security Centre recommends combining three random words, which makes a password long enough to be strong and easy enough to remember.

A few rules from the same guidance:

• Don’t use passwords based on birthdays, pet names, family names or your favourite team. These are often visible on social media.
• Swapping letters for symbols (“p@ssw0rd”) doesn’t really help, because attackers know those tricks.
• A password manager can create and remember strong passwords for you.
• Writing a password down is fine if you keep it somewhere safe at home.

Check 2: Start with your email

Your email password matters most, because every other account can be reset through it. Give it a unique password you use nowhere else.

Also readIs My Phone Hacked? 9 Checks for Android and iPhone Users

Check 3: Turn on two-step verification

Two-step verification means a stolen password alone isn’t enough to get into your account. You also need a code or a prompt on your phone.

Turn it on for these first:

• Email (Gmail, Outlook): in your account’s security settings.
• WhatsApp: Settings > Account > Two-step verification, then set a 6-digit PIN. This stops someone from registering your number on another phone with just an OTP.
• Social media (Instagram, Facebook): in Accounts Centre > Password and security.
• Net banking and UPI apps: use the app lock and never turn off the device PIN.

Prefer an authenticator app or an on-screen prompt over SMS codes where you can, since SMS can be intercepted through SIM swap fraud.

Check 4: Find Out If Your Email Was Leaked

Go to Have I Been Pwned and enter your email address. The site shows which known breaches included it. It also has a “Notify Me” option that alerts you if your email turns up in a future breach.

Checks 5 to 7: Your Phone, SIMs and Aadhaar

Check 5: Lock down your phone

Your phone holds UPI, banking, email and photos of your documents. Basic phone security does a lot of the work:

• Use a 6-digit PIN or a pattern that isn’t a straight line, plus fingerprint or face unlock.
• Install apps only from the Play Store or App Store. Never install an APK sent on WhatsApp.
• Keep the phone and apps updated.
• Review app permissions for SMS, contacts and accessibility.

Our smartphone privacy settings guide walks through the settings most people never change.

Check 6: SIMs in your name

This is the check almost nobody does. Fraudsters sometimes get SIM cards issued using someone else’s identity, then use those numbers for scams.

The Department of Telecommunications’ Sanchar Saathi portal has a service called Know Mobile Connections in Your Name. It shows the mobile connections registered in your name, and you can report any you didn’t take or no longer need. Those numbers are then flagged for re-verification.

Check 7: Aadhaar copies and biometrics

• Don’t hand out full Aadhaar photocopies casually. Where a copy is required, write the purpose and date across it before signing.
• Consider locking your Aadhaar biometrics when you don’t need them. Our Aadhaar biometric lock guide shows how.

Also readAadhaar Biometric Lock: Stop Fingerprint Fraud in 2 Minutes

Check 8, the Catch: Your OTP Is the Key, Not Your Password

Sanchar Saathi itself notes that Chakshu isn’t for reporting financial fraud that has already happened; that goes to 1930 and the cybercrime portal. Our explainers on the digital arrest scam and money missing from your bank account have step-by-step help.

Your Rights Under India’s Data Protection Law

India’s Digital Personal Data Protection Rules were notified on 13 November 2025, according to law firm Hogan Lovells. Most of the rules covering companies, including consent, security safeguards, breach intimation and your rights as a “data principal”, apply from 13 May 2027.

Once they’re in force:

• Companies must tell affected people about a personal data breach promptly through their registered contact details.
• You can withdraw consent, and the process must be as easy as giving it.
• Companies must publish how you can exercise your rights over your data.

Until then, the habits above are your main protection.

Our Verdict: The 15-Minute Plan

Honestly, the people most at risk are often parents and grandparents, who get the most fraud calls. Spend 15 minutes doing these checks on their phones too.

Frequently Asked Questions

How can I keep my personal data safe online?

Use a unique, long password for your email, turn on two-step verification, check for breaches on Have I Been Pwned, install apps only from official stores, and never share OTPs or your UPI PIN.

How do I check if my data has been leaked?

Enter your email on Have I Been Pwned. It shows known breaches that included your email and can alert you about future ones.

How do I know how many SIM cards are in my name?

Use the “Know Mobile Connections in Your Name” service on the Sanchar Saathi portal. You can report connections you didn’t take.

Where do I report a cyber fraud in India?

If money is lost, call 1930 or file a complaint at cybercrime.gov.in right away. For suspicious calls or messages without loss, use Chakshu on Sanchar Saathi.

The Bottom Line

You can keep personal data safe with a handful of checks, not expensive software. Start with your email password and two-step login tonight, then do the leak check and the SIM check this weekend.

Sources

• NCSC (UK): Three random words for passwords
• Have I Been Pwned: breach search and Notify Me
• Sanchar Saathi (DoT): Know Mobile Connections in Your Name, Chakshu, CEIR
• Hogan Lovells: DPDP Rules 2025 notified, phased timeline