How should I proceed after a data breach to improve online privacy?

[AdamVH]

After my email was involved in a data breach from a major retailer, I've become paranoid about my digital footprint and want to systematically improve my security, but I'm overwhelmed by conflicting online privacy tips. I've started using a password manager and enabling two-factor authentication where possible, but I'm unsure about the next steps, like the real value of VPNs for everyday browsing, how to effectively audit app permissions on my phone, or whether switching to more privacy-focused search engines and email providers is worth the hassle. For those who have taken a methodical approach to locking down their personal data, what were your most impactful actions after covering the basics? How do you evaluate the privacy claims of different tools and services, and what's a realistic balance between maximum security and maintaining convenience for daily online activities?