FRA website or a company exposed your details in a data breach? ShredRGPD writes your GDPR request, works out the deadlines and helps you follow up. Without ever seeing your data.
1,048 known breaches worldwide, 29 of them affecting France (Have I Been Pwned catalogue of 30 October 2026). Were you a customer? See what leaked and what to do.
Search all breachesBreaches in France, in figuresFollow new breaches
Indicative guide: high if passwords, bank details, ID documents or health data leaked; medium if a phone number, address or date of birth; low otherwise. Logos provided by Have I Been Pwned. Trademarks belong to their owners; ShredRGPD has no connection with these companies.
How it works in 45 seconds, on real breaches: see what leaked, write to the company, track the deadline.
Your data leaked. 1,039 known breaches, 27 of them in France. Around them, scraps of masked data: email, password, IBAN, date of birth.
An extract from the 2019 Deezer breach goes through the shredder. ShredRGPD: request the erasure of your data. Free, no account, no tracker.
See what leaked. Search for your email on Have I Been Pwned, tick the breaches: Free, Deezer (company logos, trademarks of their owners). Your email never goes through ShredRGPD.
Your GDPR letter, in 5 steps, pre-filled from the Free breach, with the right GDPR articles (17.1, 19, 34, 12.3). To copy, send or print.
The deadline, worked out for you: the company has one month to reply (Article 12(3) GDPR). Deadline passed? A reminder ready, a CNIL complaint.
Test it without handing it over. Its SHA-1 hash is computed in your browser; only its first 5 characters go to Pwned Passwords. The comparison happens on your device.
Your data stay with you: 0 application server, 0 tracker, 0 account, 100% in your browser.
Take back control of your data. shredrgpd.fr. Free, no account. Indicative letter templates, not legal advice.
Find the breaches that contain your email, see which data were exposed, then write to the company in one click.
A tool to defend yourself that hosts nothing: ShredRGPD has nothing to protect, because it keeps nothing.
The page declares a security policy that blocks any request to another website, except the k-anonymity password test. It is not a promise: your browser enforces it.
<!-- header of every published page --> Content-Security-Policy: connect-src https://api.pwnedpasswords.com https://shredrgpd.fr/_vercel/insights/; form-action 'none'; default-src 'self';
One month from receipt, three if the company extends it (Article 12(3)).
Each letter cites the GDPR articles it relies on, following the structure of the CNIL template.
ShredRGPD neither stores nor searches any breached data, not even hashed. It helps, it does not archive.
Subject: Request for erasure of personal data (Article 17 GDPR)
Dear Sir or Madam, I have learned that personal data concerning me were exposed in a personal data breach suffered by Free (dated 17 October 2024). According to public information about this breach, the categories of data exposed are: - bank details - date of birth - first and last name - phone number - postal address - genders Under Article 17(1) of Regulation (EU) 2016/679 (GDPR), I ask you to erase all personal data concerning me, as they are no longer necessary in relation to the purposes for which they were collected (point (a)) or as I withdraw my consent to their processing (point (b)).
No. Everything happens in your browser: there is no application server, no account, no cookie. The page blocks any request to another website, except to Pwned Passwords when you run a password test: only 5 characters of its hash are sent, never the password. To know how many people use the site, Vercel, the hosting provider, counts page views without a cookie: nothing you type is sent.
It helps you do it without seeing your data. You search for your email on Have I Been Pwned, then tick the breaches found in ShredRGPD, which shows the exposed data and prepares the letter. ShredRGPD hosts no database of breached data: only the public list of known breaches.
Often, but not always. The company must reply within one month (Article 12(3) GDPR). Without a reply, you can send a reminder and then complain to the CNIL, the French data protection authority. The templates are indicative and do not replace legal advice.
Not by default. The company may ask for additional information only if it has reasonable doubts about your identity (Article 12(6) GDPR).
Your letter is ready in a few minutes. Nothing is stored without your consent.
Write my letter
