A data diet: find, secure and delete your old online accounts

Most people have dozens of online accounts they have forgotten: a shop used once, an old forum, a free trial. Each one holds some of your personal information and a password, and each one can leak. A data diet means finding those accounts, securing the few you still need and closing the rest. In South Africa, the Protection of Personal Information Act (POPIA) also lets you ask a business to delete information it has no reason to keep.

Why old accounts matter

An account you have forgotten is an account you are not watching. If its password is the same as one you still use, a leak from that site puts your current accounts at risk. The UK National Cyber Security Centre (NCSC) explains how criminals take email and password pairs from one breach and try them automatically on other sites, a technique called credential stuffing. It works because people reuse passwords.

Old accounts also hold data you may not want kept: addresses, phone numbers, birthdays, order histories. The US Federal Trade Commission advises not to ignore a breach notice just because it concerns an account you no longer use.

Step 1: find your accounts

No single list exists, but four places get you most of the way.

• Your password manager or browser. Whatever saved your passwords has a list of sites. Google Password Manager is at passwords.google.com. KeePassXC, a free open-source password manager, can check its entries for weak and breached passwords offline.
• "Sign in with" connections. Google lists the sites you sign in to with your Google account at myaccount.google.com/linkedapps. On an iPhone, Settings, then your name, then Sign in with Apple, shows the same for Apple. GitHub lists authorised apps under Settings, Applications.
• Your mailbox. Search your email for words such as "welcome", "verify your email" and "confirm your account". Sign-up emails are a good record of accounts you forgot.
• Have I Been Pwned. The free service at haveibeenpwned.com shows which known data breaches your email address appears in. Each breach is an account you had, and a password you should not use again.

Write the list down, or keep it in your password manager.

Step 2: decide what to keep

For each account, ask three questions:

1. Do you still use it?
2. Does it hold anything you need, such as purchase records or documents?
3. Would you miss it if it disappeared?

Three "no" answers mean delete it. Anything you keep, secure properly in step 3.

Step 3: secure the accounts you keep

• A unique password for each. The NCSC suggests three random words as an easy way to make strong ones. A password manager remembers them for you.
• Two-factor sign-in wherever it is offered, starting with your email, because the NCSC points out that whoever controls your email can reset everything else.
• Up-to-date recovery details. An old phone number or a dead email address on an account means you cannot recover it, and someone else who now holds that number might.
• Fewer "sign in with" links. Each one gives another site a connection to your main account. Remove the ones you no longer need. Google and Apple both note that removing the connection does not delete your account or data at the other site; you have to do that separately.

Step 4: delete the rest

Look for a "delete account" or "close account" option in the site's settings, usually under account, privacy or security. JustDeleteMe (justdeleteme.xyz), a free open-source directory maintained by volunteers, collects direct links to the deletion pages of thousands of sites and rates how hard each one makes it.

A few things to know before you press delete:

• Download what you need first. Google, for example, recommends Google Takeout to save your data before deleting an account.
• Deactivating is not deleting. Many services offer to "deactivate" or "hibernate" an account, which hides it but keeps your data. Choose delete if you mean it.
• Most deletions have a waiting period. LinkedIn, for example, lets you reopen a closed account within about 14 days. Google lets you recover a deleted account for a limited time.
• Some addresses are gone for good. Google says a removed Gmail address cannot be used by anyone again, so you will not get it back.
• Unused accounts may close themselves. Google and Microsoft both say they may delete personal accounts that have not been used for two years. Do not rely on it: delete what you mean to delete.

Step 5: use your rights when there is no delete button

Some businesses offer no way to close an account online. POPIA gives you rights in South Africa:

• Section 23 lets you ask, free of charge, whether a business holds personal information about you.
• Section 24 lets you ask it to correct or delete information that is inaccurate, irrelevant, excessive, out of date or unlawfully obtained, or to destroy records it is no longer allowed to keep.
• Section 14 says records should not be kept longer than needed for their purpose, although the law and contracts can require some records to be kept.

Since 17 April 2025, under the amended POPIA Regulations, you can make a correction or deletion request free of charge, including by email, and the business must tell you in writing within 30 days what it has done. If it does not respond, you can complain to the Information Regulator through its eServices portal.

For services based in the European Union, the General Data Protection Regulation (GDPR) gives a right to erasure in Article 17, with a one-month deadline for a reply. Whether it applies to you depends on the service.

Make it a habit

A data diet is easier as a routine than a project. Once a year:

• check Have I Been Pwned for your addresses
• review your "sign in with" connections
• delete accounts you created and never used again

Every account you close is one less password to protect and one less place your information can leak from.

For what happens when a password does leak, our article Has your account been hacked? The signs to look for sets out the warning signs and the steps to take.

Sources

• NCSC, credential stuffing advisory: https://www.ncsc.gov.uk/files/Credential%20stuffing%20advisory.pdf
• NCSC, three random words: https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/three-random-words
• NCSC, secure your important online accounts: https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/secure-your-important-online-accounts
• US Federal Trade Commission, consumer alert on data breaches (24 October 2022): https://consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
• Google Account Help, sign in with Google connections: https://support.google.com/accounts/answer/13533235
• Google Account Help, delete your Google Account: https://support.google.com/accounts/answer/32046
• Google Account Help, download your data: https://support.google.com/accounts/answer/3024190
• Google Account Help, inactive accounts: https://support.google.com/accounts/answer/12418290
• Gmail Help, remove Gmail: https://support.google.com/mail/answer/61177
• Apple Support, Sign in with Apple: https://support.apple.com/en-us/102571
• GitHub Docs, reviewing authorised OAuth apps: https://docs.github.com/en/apps/oauth-apps/using-oauth-apps/reviewing-your-authorized-oauth-apps
• Microsoft account activity policy: https://support.microsoft.com/en-us/topic/microsoft-account-activity-policy-7c0a9fa7-0982-b7c6-fd72-df852b63699f
• LinkedIn Help, close your account: https://www.linkedin.com/help/linkedin/answer/a1379064
• KeePassXC user guide: https://keepassxc.org/docs/KeePassXC_UserGuide
• Have I Been Pwned: https://haveibeenpwned.com/
• JustDeleteMe: https://github.com/jdm-contrib/jdm
• Protection of Personal Information Act 4 of 2013: https://www.gov.za/sites/default/files/gcis_document/201409/3706726-11act4of2013protectionofpersonalinforcorrect.pdf
• Information Regulator, amended POPIA Regulations: https://inforegulator.org.za/wp-content/uploads/2025/04/POPIA-2021-Regulations-FINAL-21-Jan-2025.pdf
• Information Regulator, POPIA forms: https://inforegulator.org.za/popia-forms/
• Information Regulator, complaints: https://inforegulator.org.za/complaints/
• GDPR, Regulation (EU) 2016/679: https://eur-lex.europa.eu/eli/reg/2016/679/oj

Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.