Surveillance is increasing control over bodies of individuals, and the framework of data as a resource is facilitating this control, as illustrated here through the case of COVID-19 in India. Data governance frameworks view data as a disembodied resource, erasing its connections with people's bodies and making surveillance seem innocuous. A feminist bodies-as-data approach enables embodied harms of surveillance to be pinpointed, and recommendations to be made to alleviate them. Drawing upon research of lived experiences of marginalised communities whose voices are often left out in data protection discourse, this policy brief proposes recommendations preserving not just data privacy, but bodily integrity, autonomy, and dignity of individuals.