Your rights, step by step

The steps to follow

1. 01

   Keep evidence

   Take dated screenshots of the pages that expose you and write down their exact addresses. You will need them if you have to complain to the CNIL.

2. 02

   Find the right contact

   Look for a DPO email address or a “personal data” form in the legal notice or the privacy policy. With no contact, write to the general contact address. The generator helps you find the registrar and the hosting provider.

3. 03

   Send your erasure request

   The company must reply within one month of receipt (Article 12(3) GDPR). It may extend this by two months if it tells you so within the first month.

4. 04

   Send a reminder after one month

   Without a reply, send a reminder. If it refuses, it must tell you why (Article 12(4)).

5. 05

   Report the content to the hosting provider

   Anonymous or silent website? Write to its hosting provider: it must handle notices of illegal content (Article 16 of the EU Digital Services Act). The registrar and Cloudflare can also forward them.

6. 06

   Complain to the CNIL

   Without a satisfactory reply, you can lodge a complaint with the CNIL, the French data protection authority (Article 77). Attach your request, your reminder and your evidence.

Write my letter

Video

How ShredRGPD works in 45 seconds, on real breaches (Free, Deezer), with a fictitious person. The text in the video is in French; English subtitles and a transcript are provided.

How to send your request

The GDPR does not require any particular form: an email or the website’s form is enough. What matters is being able to prove the date of receipt, because the one-month period starts from there.

• Email or form: keep a copy of your message, the sending date and any acknowledgement (screenshot of the confirmation, ticket number).
• Registered letter with acknowledgement of receipt (lettre recommandée avec accusé de réception): the strongest proof, useful if the company does not answer emails or if you plan to complain to the CNIL. La Poste also offers registered letters online.
• Note the date of receipt in the tracker: ShredRGPD works out the deadline and can add it to your calendar.

Protect yourself at the same time

• Change the exposed password everywhere you use it, and never reuse it again.
• Turn on two-factor authentication on your important accounts, starting with your email.
• Be wary of emails, text messages and calls that quote your data: breaches are often used for phishing.
• If bank details were exposed, tell your bank.

Frequently asked questions

Do I need to attach an ID document?

Not by default. The company may ask for additional information only if it has reasonable doubts about your identity (Article 12(6) GDPR). If so, hide what is not needed.

What if the website is outside the European Union?

The GDPR also applies to websites that target people in the Union (Article 3(2)), but enforcing it is harder. Write anyway, keep your evidence and report the content to its hosting provider.

Does ShredRGPD check whether my data leaked?

ShredRGPD helps you do it without seeing your data: you search for your email on Have I Been Pwned, then tick the breaches found on the Check page. ShredRGPD shows the exposed data and prepares the letter. It hosts no breach database.