Can a tag read data from your phone?
No. The roles in the exchange are fixed: the phone powers the tag and issues commands, the tag answers them. A tag has no way to request anything, and even if it could, nothing on the phone would be reachable, because the tag is talking to the radio and not to your files.
The roles are fixed
In a tag read the phone is the initiator. It creates the field, powers the tag, and sends commands. The tag responds and does nothing unprompted.
There is no command in the direction the question imagines. A tag cannot ask the phone for a contact list because the protocol gives it no way to ask for anything.
This is not a permission that could be granted or a setting that could be wrong. It is the shape of the exchange.
Even if it could ask
Suppose a tag could issue a request. It would be talking to the phone's NFC subsystem, which is a radio interface, not to storage.
Reaching your photographs or messages would require going through the operating system, the application sandbox and the permission model, none of which is exposed over the radio to a tag.
So the answer holds at two independent levels, and either alone would be enough.
Where the fear comes from
Card emulation, where a phone behaves like a card and a reader initiates. That is the reverse arrangement and it involves a reader you are presenting the phone to, not a tag.
The general anxiety about wireless technologies, most of which do have two way capability and some of which do announce themselves continuously.
And the fact that tapping a tag makes the phone do something, which looks like the tag reaching into the phone when it is the phone acting on what it read.
That last one is the important distinction: the tag proposes content, and the phone decides what to do with it.
What is worth being careful about
Not the tag reading you. The address it offers, and what you do next.
A tag can hold an address that leads somewhere hostile, exactly as a printed link can, and the defence is the same: look before following.
A tag can also hold content designed to make an application behave badly, which is a question about the application rather than about NFC and is covered separately.
Reading an unfamiliar tag with a tool that displays its content, rather than letting the phone act, is the one habit worth having.
Frequently asked questions
Can a tag steal my contacts or photos?
No. A tag cannot issue a request at all, and the radio interface is not a route to storage even if it could.
Is that a setting I should check?
No. It is the shape of the exchange rather than a permission. The tag only ever answers.
What about when my phone acts like a card?
That is card emulation, the reverse arrangement, and it involves a reader you deliberately present the phone to.
So what should I be careful about?
The address a tag offers, and what you do after it opens. Look at the content before letting the phone act on it.