The first and foremost step is to never buy cryptocurrency from centralized exchanges, that is where most of your privacy data gets leaked. Then we can use VPN or TOR to avoid our traces on internet but my suggestion is TOR since even most of the VPN tracks our data and sell them as well.
Centralized exchanges will not be problem if you didn’t pass KYC. Most of those can use without KYC but definitely will set a limit withdrawal in daily. So there no chances to leaked your personal data. Yeah, Tor can be a effective way to hide an identity of personal information. But i think keep 100% anonymity is very difficult. Due to a little carelessness, it could have been revealed to someone else.