We began this book with a small, slightly unsettling claim: that you have a double, assembled without your permission, living a busy life in systems you have never seen. Seven chapters later, you have met that double properly. You have watched it be born in a form, carried like a parcel across the network, auctioned in a bazaar, judged in a mirror, and copied by people who should not have had it. You have learned how it can defend itself, and where those defences run out.
So here is the honest situation, stated plainly. Your datafolk is not going away. It will accompany you for the rest of your life, and it will outlive most of your passwords and a few of your relationships. The question this final chapter asks is not how to be rid of it, which is impossible, nor how to hide it, which is only partly possible, but something harder and more hopeful: on what terms do we live with it?
You Cannot Out-Engineer a System Alone
The previous chapter handed you personal tools, encryption, permissions, the word no. They matter. But it would be a quiet cruelty to end the book there, because the largest truth about data is one no individual tool can fix.
The fix cannot only be personal. A billion people cannot each be expected to read every privacy policy, audit every app, and out-engineer systems built by the best-funded engineering teams on earth. Telling each citizen to simply “manage their privacy” is like telling each commuter to personally inspect the brakes on the train. At some point, the responsibility has to sit with whoever built and runs the train. Privacy that depends entirely on individual vigilance is not privacy. It is a stylish way of blaming the passenger.
This is why the second half of the answer is collective, and it goes by a less thrilling name than encryption: regulation. India spent years arriving at it. A committee led by a former Supreme Court judge laid out the principles, that data must be collected fairly, used for stated purposes, and held by those who owe the person a duty of care.2 Out of that, eventually, came the Digital Personal Data Protection Act of 2023.1
The Words That Could Matter, If We Mean Them
The new law is not a force field, and it would be naive to pretend otherwise. But for the first time, it writes down rights your datafolk never formally had, and the words are worth knowing, because a right you cannot name is a right you cannot claim.
It calls the bank, the app, the hospital a data fiduciary The term India's data law uses for whoever decides why and how your data is processed. 'Fiduciary' implies a duty of care — the way a trustee owes one. , a word chosen on purpose, because a fiduciary is not just a holder of your data but someone who owes you a duty of care for it. It insists on consent Your agreement to a use of your data — meaningful only when it is informed, specific, and freely refusable. that is specific and informed, against which we should hold a hard standard: consent only means something when refusal is real. An “I Agree” you must tap to receive your own salary is not a choice; it is a toll booth. It gestures at data minimisation The principle that a system should collect only what it needs, and keep it only as long as it needs to. , the quiet hero of this whole book, because the safest datafolk is the one that was never created. And it introduces a right to erasure The right to ask that your data be deleted when it is no longer needed. , which is nothing less than an attempt to argue with the iron rule of Chapter 5, to give a little forgetting back to machines designed never to forget.
None of this is automatic. Europe’s stronger, older regime3 shows both what such rights can win and how easily they decay into cookie banners everyone clicks through. A law is only ever the floor. Whether your fiduciary feels the duty, or merely files it, depends on enforcement, on journalism, on courts, and on whether enough ordinary people know the rights exist to demand them. Which, not coincidentally, is part of what a book like this is for.
Visibility Is Still the Beginning of Agency
Step back far enough and a more hopeful shape appears, one that runs against the despair the surveillance bookshelf usually leaves behind.
Our datafolk are not only a vulnerability. They are also, collectively, the thing that made UPI reach a vegetable vendor, that let a migrant worker carry his identity across state lines, that warned a city before a flood. Data is not the villain of this book; opacity is. The goal was never to delete our digital selves but to drag them into the light, to make the bazaar visible, the mirror arguable, the copying understood, so that the systems answer to the people inside them rather than the other way round.
The book’s first chapter made a promise: that visibility leads to agency. Having read this far, you can now test it. You can see the auction behind the ad, the model behind the rejection, the envelope behind the encrypted message, the fiduciary behind the form. You will not have solved your data problems, no one has, and anyone who says they have is selling the app that collects the rest. But you can see the machinery now. And a person who can see the machinery asks different questions, signs different agreements, builds different systems, and votes for different rules.
That is the whole wager of this book, and it is not a small one: that a citizen who understands their datafolk is harder to exploit, and a society full of such citizens is harder to build the wrong way.
A Note Before You Go
You came into this book with a double you had never met. You leave it, I hope, on speaking terms with it, neither paranoid nor naive, but literate, which was always the only goal.
Your datafolk is still out there, scattered across servers in Mumbai and Virginia and Singapore, being born and carried and traded and predicted as you read this sentence. That has not changed. What has changed is that you can now picture it doing so, and a thing you can picture is a thing you can question, and a thing you can question is a thing you can, slowly and together, begin to make fairer.
The companion lab is still open, if you’d like to keep poking at the machinery, trace a packet, watch a payment hop through six systems, see how anonymised data gets un-anonymised. The book ends here. Your datafolk’s story does not. But for the first time, you are awake inside it, and that, it turns out, was the point all along.
Go gently. Carry your double consciously. It will be with you a long time.
This is the final chapter of Datafolks: The Hidden Lives of Our Digital Self. Return to the book, or wander back to the beginning and meet your datafolk again, this time knowing where the story goes.