A personal data privacy checklist helps you systematically protect your photos, files, and personal information from AI training, data breaches, and unauthorized access. In 2026, with major cloud providers updating Terms of Service to allow AI model training on user content, taking control of your data has never been more important. This 10-step guide covers everything from auditing your cloud storage to switching to encrypted offline backup devices like Maktar Qubii Power and Nukii.
The numbers are stark. According to the IBM Cost of a Data Breach Report 2025, the average cost of a data breach reached $4.88 million globally — the highest figure ever recorded. The Identity Theft Resource Center reported over 3,200 data compromises in the United States in 2024, exposing more than 1.7 billion records. And those are just the breaches that companies disclosed. Meanwhile, AI companies are training models on increasingly vast datasets scraped from the internet and cloud platforms, often with user consent buried in Terms of Service that virtually nobody reads.
This checklist gives you a concrete, step-by-step plan to take back control. Print it, bookmark it, and revisit it every quarter.
For a deeper look at AI training policies, see our guide: Is Your Cloud Provider Using Your Photos for AI Training?
Why 2026 Is Different
The privacy landscape has shifted dramatically in the past two years. Here is what changed:
- Google's expanded AI training policy. Google updated its privacy policy in July 2023 to explicitly state it may use publicly available information to train AI models like Bard and Gemini. Subsequent 2025 updates broadened these rights to include content stored in Google services for "service improvement" — a category broad enough to include Google Photos and Google Drive.
- Adobe's Terms of Service controversy. In June 2024, Adobe faced backlash after updated Terms of Service appeared to grant the company rights to access and use content stored in Creative Cloud for machine learning. Though Adobe clarified its position, the episode exposed how easily cloud-stored creative work can become training data.
- Meta's AI training on user content. Meta began using public posts, photos, and comments on Facebook and Instagram to train its AI models in 2023. In 2025, it expanded this to include more content categories across its platforms, with opt-out processes that many users found difficult to navigate.
- Record data breaches. The National Public Data breach of 2024 exposed Social Security numbers and personal details of an estimated 2.9 billion records. The MOVEit vulnerability compromised over 2,600 organizations. Breach frequency and scale continue to climb in 2026.
- Regulatory gaps. Despite the EU's AI Act taking effect and various US state privacy laws expanding, enforcement remains inconsistent. Federal comprehensive privacy legislation in the United States is still pending. Your data protection ultimately depends on your own actions.
The bottom line: if your photos, documents, and personal files sit in cloud storage, they are subject to Terms of Service that can change at any time. The only data fully under your control is data you physically possess.
The 10-Step Personal Data Privacy Checklist
Step 1: Audit Your Cloud Storage Accounts
Start by taking inventory. Log into every cloud service you use — iCloud, Google Drive, Google Photos, Dropbox, OneDrive, Amazon Photos — and note what is stored there. Most people have more cloud accounts than they realize, some dating back years with photos and files they forgot existed.
Make a list with three columns: Service Name, What's Stored, and Keep or Remove. Be thorough. Check old email accounts for Google Drive attachments. Look at your phone's app list for cloud services you may have installed once and forgotten.
Step 2: Review Terms of Service for AI Training Clauses
For each service on your list, search the current Terms of Service for language about AI, machine learning, content licensing, or service improvement. Key phrases to look for include "train models," "improve our services using your content," "machine learning," and "automated analysis."
We covered this in detail in our article on cloud providers using photos for AI training. The short version: most major providers now include some form of AI training clause. Some offer opt-out options, but they are often buried in settings menus and may not fully prevent your data from being processed.
Step 3: Download and Delete Cloud Photos You Want to Keep Private
Use your provider's data export tools to download anything you want to keep: Google Takeout for Google services, iCloud data export for Apple, and the download features built into Dropbox and OneDrive. Save these files to your computer first.
Important: After downloading, delete the originals from the cloud. Then empty the trash — most providers retain deleted files for 30 to 60 days. Google keeps trashed files for 30 days. iCloud retains recently deleted photos for 30 days. Until you empty the trash, your data is still on their servers.
Step 4: Set Up Automatic Offline Backup (Qubii Power)
Once you have removed private photos from the cloud, you need a replacement backup system. Qubii Power solves this by backing up your iPhone or Android photos, videos, and contacts to a microSD card every time you charge your phone.
Here is why this matters for privacy:
- No internet connection. Qubii Power works entirely offline. Your photos never touch a server.
- No subscription. Unlike iCloud ($2.99-$12.99/month) or Google One ($1.99-$9.99/month), Qubii Power is a one-time purchase.
- No Terms of Service changes. A microSD card in your drawer cannot update its privacy policy.
- Automatic and effortless. Plug in your phone to charge, and backup happens in the background. No manual steps after initial setup.
For setup instructions, see our Qubii Power Complete Setup Guide.
Step 5: Encrypt Sensitive Files (Nukii NFC Flash Drive)
Photos are one category. But what about tax returns, medical records, legal documents, and financial statements? These need encryption — not just offline storage.
Nukii is an encrypted flash drive that uses AES-256 hardware encryption, unlocked by tapping your phone via NFC. No passwords to type, no software to install, no cloud authentication. If someone steals the drive, the data is unreadable without your phone's NFC tap.
Use Nukii for:
- Tax documents and financial records
- Medical records and insurance documents
- Legal contracts and sensitive correspondence
- Private photos you do not want on any networked device
- Business files with confidential client data
Learn more in our Encrypted Storage Guide.
Step 6: Enable Two-Factor Authentication Everywhere
Two-factor authentication (2FA) is the single most effective way to prevent unauthorized account access. According to Microsoft, 2FA blocks 99.9% of automated account attacks.
Enable 2FA on every account that supports it: email, banking, social media, cloud storage, shopping sites. Use an authenticator app (Google Authenticator, Authy, or Microsoft Authenticator) rather than SMS-based 2FA. SMS is vulnerable to SIM-swapping attacks, which increased 400% between 2021 and 2024 according to the FBI's Internet Crime Complaint Center.
Step 7: Review App Permissions on Your Phone
On iPhone: Go to Settings > Privacy & Security and review each category — Photos, Camera, Microphone, Location, Contacts. Revoke access for any app that does not need it.
On Android: Go to Settings > Apps and review permissions for each app, or go to Settings > Privacy > Permission Manager for a category-by-category view.
Pay special attention to photo library access. Many apps request full photo access when they only need the camera. Use "Limited Access" on iPhone (iOS 14+) or "Allow selected photos" to restrict what apps can see.
For a detailed walkthrough, see our guide on how to protect your photos from AI scraping.
Step 8: Use a Password Manager
The average person has over 100 online accounts. Reusing passwords across these accounts means a single breach exposes all of them. The 2024 RockYou2024 leak compiled nearly 10 billion unique passwords from multiple breaches — chances are high that at least one of your passwords appeared in it.
Choose a reputable password manager — 1Password, Bitwarden, Apple Passwords, or Dashlane — and generate unique, random passwords for every account. Most password managers also alert you when your credentials appear in known breaches, so you can change compromised passwords immediately.
Step 9: Set Up an Automatic Device Backup Schedule
Privacy and backup go hand in hand. If you lose your phone or it gets stolen, you need your data to exist somewhere safe. Create a routine:
- Daily (automatic): Charge your phone with Qubii Power plugged in. Photos, videos, and contacts back up automatically.
- Weekly: Copy important computer files to your Nukii encrypted flash drive or an external hard drive.
- Monthly: Verify your backups by spot-checking that recent files appear on your backup media.
The best backup system is one you do not have to think about. That is why automatic solutions like Qubii Power outperform manual backup habits — they run every time you charge, with zero effort.
Step 10: Create a Quarterly Privacy Review Habit
Set a recurring calendar event every 90 days to re-run this checklist. Privacy is not something you set up once and forget. Cloud providers update Terms of Service. New apps request permissions. Data breaches expose credentials. A quarterly review catches changes before they become problems.
During each quarterly review:
- Re-check cloud Terms of Service for AI training policy changes
- Audit new apps installed since your last review
- Check Have I Been Pwned for new breach exposures
- Update any compromised passwords
- Verify your Qubii Power and Nukii backups are current
- Review and revoke unnecessary app permissions
Tools You Will Need
| Tool | Purpose | Cost |
|---|---|---|
| Qubii Power | Automatic offline phone backup (photos, videos, contacts) | $89.99 (one-time) |
| microSD card (256GB+) | Storage for Qubii Power backups | $20-$35 |
| Nukii | AES-256 encrypted flash drive for sensitive documents | $89.99 (one-time) |
| Password manager | Unique passwords for every account | Free-$5/month |
| Authenticator app | Two-factor authentication | Free |
Printable Checklist Summary
Save or print this quick-reference version:
- Audit cloud storage — List every cloud account and what is stored there
- Review ToS for AI clauses — Check for machine learning and content licensing language
- Download and delete — Export private photos from cloud, then delete and empty trash
- Set up Qubii Power — Automatic offline photo backup every time you charge
- Encrypt with Nukii — Store sensitive documents on AES-256 encrypted flash drive
- Enable 2FA everywhere — Use an authenticator app, not SMS
- Review app permissions — Revoke unnecessary photo, camera, and location access
- Use a password manager — Unique random passwords for every account
- Automate backups — Daily phone backup, weekly computer backup, monthly verification
- Quarterly review — Re-run this checklist every 90 days
Frequently Asked Questions
What is a personal data privacy checklist?
A personal data privacy checklist is a systematic list of steps you follow to protect your photos, files, and personal information from unauthorized access, data breaches, and AI training. It covers auditing your cloud storage, reviewing Terms of Service, setting up encrypted backups, enabling two-factor authentication, and establishing regular privacy review habits. Think of it as a maintenance routine for your digital life — just like you lock your front door, you need to routinely secure your data.
Can cloud providers use my photos for AI training?
Yes. As of 2026, several major cloud providers have updated their Terms of Service to permit using uploaded content — including photos — for AI model training and service improvement. Google updated its privacy policy in 2023 to allow publicly available data for AI training, and subsequent updates have expanded these rights. Adobe and Meta have faced similar controversies. The safest approach is to store private photos offline using devices like Qubii Power, which backs up to a local microSD card with no internet connection. Read our full analysis: Is Your Cloud Provider Using Your Photos for AI Training?
How do I protect my photos from AI scraping?
Five steps: (1) Download and delete photos from cloud services that allow AI training, (2) Switch to offline backup using Qubii Power, which stores photos on a microSD card with no internet access, (3) Store sensitive photos on a Nukii encrypted flash drive with AES-256 hardware encryption, (4) Disable photo-sharing permissions in social media apps, and (5) Review cloud Terms of Service quarterly for policy changes. For a comprehensive walkthrough, see our guide on protecting photos from AI scraping.
What is the best way to back up personal data without using the cloud?
The best approach combines automatic photo backup with encrypted document storage. Qubii Power backs up your iPhone or Android photos, videos, and contacts to a microSD card every time you charge — no internet, no subscription, no cloud. For sensitive documents, Nukii provides AES-256 hardware encryption unlocked by NFC tap from your phone. Together, they cover daily photo backup and secure file storage without any data leaving your physical possession. Visit our Phone Backup Guide for more options.
How often should I review my privacy settings?
At least once every 90 days (quarterly). Cloud providers update Terms of Service regularly, new apps request permissions, and data breaches expose credentials. A quarterly review lets you catch policy changes, revoke unnecessary app permissions, verify backups are working, and update compromised passwords. Set a recurring calendar reminder. Between quarterly reviews, check Have I Been Pwned whenever a major breach makes the news to see if your accounts were affected.
Your data is your responsibility. Cloud providers will keep changing their Terms of Service. Hackers will keep finding new vulnerabilities. AI companies will keep expanding their training datasets. The only reliable defense is taking physical control of your most important files and building privacy habits that you maintain over time.
Start with Step 1 today. You do not need to complete all 10 steps in one sitting — even completing the first three will put you ahead of 90% of people. For more privacy and backup guides, visit our Phone Backup Guide Hub.