Key Takeaways
Summary
22 items · 30–60 minutes
Why You Need a Personal Data Security Audit
Most people assume a breach happens to someone else — until it happens to them. The reality is that unauthorized access to personal accounts rarely involves sophisticated hacking. More often, it exploits something preventable: a recycled password, an app granted too many permissions, or an old account left open and forgotten.
A personal data security audit is a structured self-check. It doesn't require technical expertise — just focused attention and about an hour of your time. Think of it the way you might think of checking your smoke detectors or reviewing your bank statements: a routine precaution that catches problems early.
Before you start, it helps to understand what you're protecting. Every login, search, and app interaction leaves traces — your digital footprint is larger than most people realize, and reducing unnecessary exposure is one of the most effective things you can do.
Passwords and Login Credentials
Two-Factor Authentication (2FA)
App Permissions and Connected Services
Old and Unused Accounts
Device Security
Privacy Settings and Data Sharing
Tools You'll Need to Run This Audit
You don't need to install anything special. The tools below are either built into your devices or freely available through your existing accounts. Gather access to all of them before you begin so you can move through the checklist without interruption.
Have I Been Pwned (haveibeenpwned.com)
Check whether your email address has appeared in any publicly known data breaches.
Password manager
Generate and securely store unique, strong passwords for every account you hold.
Authenticator app (any TOTP-compatible app)
Generate time-based one-time codes for two-factor authentication as a more secure alternative to SMS.
Your device's system settings
Review and manage app permissions, screen lock, encryption, and software update status.
Email inbox search
Search for account registration emails to surface old or forgotten online accounts.
How to Act on What You Find
Running the audit is only useful if you follow through. When you discover an issue — a reused password, an app with location access you didn't knowingly grant, an account you forgot existed — address it the same day rather than adding it to a mental to-do list.
Don't Defer Issues You Discover
It's tempting to note a problem and plan to fix it later. In practice, deferred security tasks rarely get done. If you find a reused password or an app with excessive permissions during this audit, address it before moving to the next item. A partial audit that results in real changes is far more valuable than a complete audit that results in none.
Breach Notifications Require Immediate Action
If a service notifies you that your account was part of a data breach, treat it as urgent rather than informational. Change the password for that account immediately, update it everywhere you reused the same password, and check whether 2FA was enabled. Delays increase the window of exposure significantly.
For account security habits you want to carry forward after this audit, see our companion guide on keeping your accounts safe across every app you use. For a deeper look at the specific settings that most apps default to without your awareness, privacy settings that are easy to overlook on everyday apps is a useful next read.
Finally, be alert to social engineering attempts that can render even strong security habits ineffective. Understanding how phishing attacks are constructed and how to spot them is a practical complement to everything in this checklist.
Plan to repeat this audit every three to six months — or immediately after any suspected account compromise or data breach notification.