The individual’s participation in protecting personal data was greatly respected and considered a major principle while modern data protection rules were taking shape in the 1980s. During the following decades, however, the principle has been largely underutilised for the reason that individuals oftentimes find it difficult to get involved in such undertaking. This has been further deteriorated when big data analytics formulate an unpredictable data dynamic that creates a wide range of economic, cognitive and operational obstacles for individuals to stay relevant. This paper attempts to examine to what extent can data protection law accommodate and achieve the idea of ‘citizen empowerment’ and focuses on the role of an individual in minimising the risks and harms of big data analytics. It principally looks at the legislative efforts in the EU reform of data protection law, aside from the emergence of decentralised technologies that assist individuals in fully controlling their personal data. The paper begins by tracing back to the foundation of data protection law – the OCED Privacy Framework. It takes the individual participation principle it creates as an entry point and examines its compatibility with the idea of citizen empowerment. Particularly, the paper argues the importance of individual checks among a majority of paternalistic and corporate-centric rules and explores the legal basis for achieving citizen empowerment and user-centric rules in the context of data protection. Further, it examines the flexibility of individual participation principle in the era of big data and looks at the European approach to user control, taking the newly created right to data portability as a case study. Notably, this right is considered a critical step to formulate a new dynamic featuring ‘individual centricity’, thus enabling individuals to take advantage of personal data for their own good and ultimately share the enormous benefits of big data