Keep your data private, take an extra second to observe your own actions when you go about your day. Predicting how an attacker could get your data is difficult, but the thumb-rule is to never supply more information than what is needed.
For example, don’t click unnecessary links in your email, don’t reveal your birthday to unverified callers on phone or websites, and don’t send a photo of your ID proofs to an unknown WhatsApp number. When on Facebook, avoid giving apps personal information that claim to ‘predict your future’ or to ‘describe your perfect life partner’.
Similarly, avoid clicking on random links from unverified sources who promise prizes, since they may try and steal your personal details. These details could then be sold onwards, used to send more spam or even help them hack into your user accounts.