This thesis examines whether the GDPR affords individuals a right to control the online commodification of their personal data. The thesis investigates whether the intention that ‘Natural persons shall have control over their personal data’ in Recital 7 GDPR is given effect in the substantive provisions of the Regulation. Set against a backdrop of the many problems associated with the online commodification of personal data, the thesis posits that these are the issues individuals would like to address through a right to control. While these problems cover a wide gamut, the thesis focuses on the objections to online commodification, privacy invasions, and unfair bargains, which are systemic to the commercial surveillance which forms the basis for the commodification of personal data. The thesis examines the possibility of a right of control to be found in the data processing principles in Article 5 GDPR by way of the jurisprudential concept of informational self-determination. The thesis considers whether the use of consent as a legal basis of processing in Article 6 GDPR or the user rights in Chapter III GDPR give rise to a right to consent, and whether the information requirements in Articles 12-14 GDPR facilitates such a right. The thesis also examines whether the enforcement provisions in Articles 77-79 GDPR and 82 GDPR give effect to a right to control. In its findings, the thesis concludes that while many of the substantive provisions include elements of control, these provisions cannot be said to afford individuals the control they seek and as suggested by the wording of Recital 7 GDPR. The legal rights do not overlap with the rights sought; they are too limited and uncertain; and the technological environment has become so ubiquitous, complex, and interconnected that the individuals cannot meaningfully exercise control. Thus, the thesis questions whether it is even possible for individuals to achieve control over the online commodification of their personal data.