Data Protection Rights Every EU Internet User Should Know
Maxime Dupré
10/19/2026
Every account, delivery and newsletter leaves personal data with another company. Since May 2018, the General Data Protection Regulation (GDPR) has given people in the EU concrete ways to see that data, correct it and in many cases have it deleted. These tools cost nothing and require no lawyer, yet few people ever use them. The rules also cover companies based outside the EU whenever they offer services to people in it.
What Personal Data Online Services Keep
The obvious part is what you typed in yourself: name, email, address and payment details. Services also record what you did with them, from purchase history and login times to device identifiers and IP addresses. Some of this data is needed to run the service, while the rest often feeds analytics or advertising.
A privacy policy has to state which categories of data a company collects, why it uses them, who receives them and how long they are kept. These policies are rarely read, but they show where a later request should start.
Online casinos hold more personal data than most websites, because licensed operators must verify each player’s identity before paying out winnings. ID copies, proof of address and payment histories all end up in the player’s file. A player at nv casino eu, like a customer of any service that handles EU users’ data, can ask for a copy of the stored documents or have an outdated address corrected. At the same time, anti-money laundering rules oblige casino operators to keep certain records for several years, so not every request to delete casino account data can be fulfilled at once.
The Core GDPR Rights at a Glance
The regulation lists several individual rights, each tied to its own article. Knowing the article number helps when a support team answers vaguely, since a request that cites the exact provision is harder to brush aside.
| Right | GDPR article | What you can ask for |
|---|---|---|
| Access | Article 15 | A copy of your data and details on how it is used, shared and stored |
| Rectification | Article 16 | Correction of inaccurate or incomplete data |
| Erasure | Article 17 | Deletion of data that is no longer needed or was processed unlawfully |
| Restriction | Article 18 | A pause on processing while a dispute is being resolved |
| Portability | Article 20 | Your data in a machine-readable format to move to another service |
| Objection | Article 21 | An end to processing based on legitimate interests, including all direct marketing |
| Automated decisions | Article 22 | A human review of decisions made solely by algorithms with significant effects |
Erasure is the right with the most exceptions. A company may keep data it needs to meet a legal obligation, which is the situation of casinos, banks and insurers. Objection to direct marketing, by contrast, is absolute: once you object, the company must stop using your data for that purpose. Portability has a narrower scope and covers only the data you provided yourself, when it is processed on the basis of consent or a contract.
How to Exercise Your Rights Step by Step
Requests follow the same order no matter which company holds the data:
Find the data protection contact in the company’s privacy policy. Larger companies name a data protection officer, while smaller ones give a general privacy email address.
Send a written request that names the right and the article, for example “I request access to my personal data under Article 15 GDPR”. Email works, and some services offer a form in the account settings.
Confirm your identity if the company asks for it.
Wait for the reply. The company must respond within one month and can extend this by two further months for complex cases, as long as it explains why.
File a complaint with the data protection authority in your country if the answer is missing or unsatisfactory.
In most cases, a request is free of charge. A company may charge a reasonable fee or refuse only when a request is clearly unfounded or excessive, for example when the same person asks for the same data every week. Keeping copies of all emails helps if the case later reaches the authority.
A complete answer to an access request goes beyond a simple data export. It should also name the purposes of processing, the recipients, the planned retention period and the source of any data the company did not collect from you directly.
GDPR works best for people who use it. A single access request often shows how much a company knows and how long it keeps that information, which makes later decisions about deleting accounts or refusing marketing far easier. With the one-month deadline written into law, the effort on the user’s side is usually just one email. Before closing an old account, an access request also shows what will disappear and what the company is allowed to keep.