How to share and handle your personal documents safely

At a glance

Before you send anyone your Aadhaar, PAN, bank statement or other document, do four things: mask or redact what they don’t need to see, send the minimum (fewest pages, fewest months), use a safe channel rather than a WhatsApp or email forward, and delete or expire the copy once it’s served its purpose. A document you never over-shared, and that doesn’t linger in a dozen chats, can’t come back to harm you.

Educational resource only. This is a practical guide to sharing personal documents safely in India, in line with the data-minimisation ideas behind India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.

Why document sharing is where most leaks start

Your documents are the highest-value data you hold — and casual sharing is how they escape.

An Aadhaar copy, a PAN card, a bank statement or a passport scan is worth far more to a fraudster than a stray email address — it enables impersonation, fake accounts and loan fraud. Yet these are exactly the files people fire off in a WhatsApp chat, email as a plain attachment, or leave sitting in a phone gallery. Once a document is out, you can’t recall it. So the goal is to share less of it, less often, through safer routes — and this guide is the umbrella; each document and technique below has its own detailed page.

The four habits of safe sharing

Almost all safe document handling comes down to four repeatable habits.

1. Mask or redact what they don’t need. Hide the parts the recipient has no reason to see — use a masked Aadhaar (first eight digits hidden), black out an account number where only a name is needed, and add a purpose watermark.
2. Send the minimum. Only the pages and periods actually required — three months of statements, not a year; one document, not your whole folder. Less shared is less exposed.
3. Use a safe channel. Prefer a secure, expiring link or the organisation’s official upload portal over a WhatsApp forward or a plain email attachment that lives in inboxes forever.
4. Delete or expire the copy. Once the purpose is done, remove the file from chats and shared drives, and favour links that expire on their own.

Per-document specifics — what to mask and when to delete

Each document has its own “what to hide and how long to keep it” — these pages carry the detail.

The masking and retention rules differ by document, which is why each has a dedicated guide in this section:

• Aadhaar — use a masked Aadhaar or a Virtual ID; never share the full number where a masked copy will do.
• PAN — share only where genuinely required (it’s tied to your finances and identity); avoid plain-email copies.
• Bank statements — send only the months needed, and mask the account number where the recipient only needs to see balances or names.
• Passport, driving licence, Voter ID, KYC, property or medical documents — each carries specific risks and redaction rules covered on its own page.

Use the per-document guides for the exact “mask this, keep for that long” instructions; the four habits above are the frame they all sit in.

Safer channels than a WhatsApp forward

How you send a document matters as much as what’s in it.

• Avoid WhatsApp and plain email for sensitive documents — copies persist in chats, backups and inboxes you don’t control.
• Prefer expiring or one-time links, and official upload portals, which don’t leave a permanent copy sitting around.
• Password-protect a PDF before sending where a link isn’t possible, and share the password separately.
• Store securely — DigiLocker for government IDs rather than a photo gallery, and strip hidden metadata from scans.

Each of these techniques has its own how-to in this section — this anchor points you to them.

FAQ