Afraid of a data breach? You don't give it up in the first place.

Data breaches have delivered so many passwords, birthdates and Social Security numbers to the dark web, the whole idea of protecting your identity might feel like a lost cause.

But experts say there’s still good reason to fight for your data privacy. And here’s one way to start: Resist giving it up in the first place.

That big-box retailer does not really need your birthdate to enroll you in its loyalty program. That doctor can treat you without knowing your Social Security number. Your favorite pizza place might want to store your credit card number, but you could also just type it in.

“We’re often asked for our data in situations where it’s not needed,” said Kimberly Palmer, personal finance expert at NerdWallet.

The problem with repeatedly sharing your data, experts say, is that each time you do, you potentially heighten the risk of falling prey to identity thieves.

Last August, a little-known Florida company called National Public Data acknowledged the theft of 2.9 billion records, including names, addresses and Social Security numbers dating back decades.

And that wasn’t even the biggest breach. Back in 2013, hackers compromised 3 billion Yahoo accounts, stealing names, email addresses, telephone numbers, dates of birth and other data.

Hackers have breached some of the most secure networks in America. In 2017, thieves swiped the data of nearly 150 million Americans from Equifax, the credit reporting agency. More recently, Elon Musk’s Department of Government Efficiency has gained access to innumerable government records, raising fresh fears of a breach.

“One thing that is underscored repeatedly is that you just can’t control where your data goes,” said Derek Kravitz, deputy editor for special projects at Consumer Reports. “Every expert will say it’s unrealistic to think you can control all of the PII,” or personally identifiable information, “that’s out there.”

But that’s not a reason to give up. Here are some tips, from Kravitz and other experts.

Prioritize your data

A credit card number can be changed. A birthdate cannot.

In safeguarding your data, prioritize data that cannot be easily replaced, said Steve Grobman, chief technology officer at McAfee.

“If you lose your credit card, you can cancel your credit card,” he said. By contrast, “once your Social Security number is in the wrong hands, there’s not an easy way to take it back,” he said.

“Not all valuable data should be treated equally,” Grobman said. With each data point, ask this question: “If it does fall into the wrong hands, is it something that you can mitigate completely?”

Consumers should be most careful with immutable data, like Social Security numbers, birthdates and driver’s license numbers, which are difficult or impossible to change.

Think about who wants your data

A government agency or lender might have a legitimate reason to ask for a Social Security number or date of birth, and you may have a compelling reason to supply it: Maybe you need a new passport, or a mortgage.

But you may also be asked for a date of birth or driver’s license number at the return counter at the mall, or in an application for a discount program.

Think hard, Grobman said, “before you give your Social Security number to Bob’s Pizza to join their pizza club.”

Give up data on a need-to-know basis

We tend to fill out forms “on autopilot,” Palmer said, handing over personal data on request to just about anyone.

One recent morning, Palmer was filling out a form for a medical practice. The form asked for a Social Security number. She left it blank.

“I’ve always left it blank, and I’ve never had any problems,” she said. “I would definitely encourage people to question whenever they’re asked for data that doesn’t seem necessary.”

If someone requests a high-stakes piece of personal information, find out if the requester really needs it.

“It’s a mindset: Only giving information out that is required,” Kravitz said.

Beware of unsolicited calls or texts

In the world of data scams, unsolicited phone calls, emails and text messages are red flags, experts say.

If someone contacts you for personal data, it’s probably never wise to give it up. If you think the request may be genuine, and it comes from a familiar source, then go to the bookmarked website and initiate contact yourself, or call the number on your statement.

“Never engage with somebody who makes the contact to you,” Grobman said. “Don’t click on the links in the email.”

If the communication sounds urgent, all the more reason to assume it’s a scam.

“When you’re in these situations, step one is just to stop,” Grobman said. “There’s almost nothing in this world where acting instantly is required.”

In the spirit of data privacy, here are two more boilerplate rules to follow if you want to stay safe.

Use multifactor authentication

You probably do this already: When you sign in to your bank, your 401(k) account or any other site that’s reasonably secure, you endure the mild tedium of entering a PIN that’s been sent to your cellphone.

Multifactor authentication “can keep identity thieves from accessing your accounts if they only have your username and password,” said Margaret Poe, head of consumer credit education at TransUnion.

Scam victims often report that they neglected to enable two-step authentication on their plundered accounts, Kravitz said. If it’s an option, he said, you should activate it.