

Thing is there’s somehow not much coverage on this topic in the media. I only got our internal corporate documents because at our place we’re preparing for it for months already. Its not that easy to invite third parties to a big piece of your cloud iot setup.
EDIT: here is longer but good source. The law came into power somewhere last year but companies had some extra time to prepare their shit which times out September 12
https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained
I think there’s some „reasonable” keyword in the right to be forgotten. Like first if you have some old backups on tapes and you must keep them for whatever reason still for few years m, you can deny altering them if it the cost would be exorbitant and you ensure the users won’t come back after a recovery from said backup.
Also they might train their models on pseudo-anonymized dataset so as long it’s too expensive to deanonymize the user data it could be fine in terms of GDPR.
For example: you generate car trips stats per city in a country, per day. You could argue that you don’t need to delete user data that is part of this set if you ensure there are always enough of trips recorded (so can’t deanonymise someone from a single entry) and also it would falsify your historical stats.
At my company who likes to be super compliant we do remove people from this kind of stats using some pseudo-anonymous references. So if you remove your account, there’s an event that changes the historical analytics data and removes all traces of your activity. But that’s because we can and want to be cool (company culture principles).
Other data we have (website analytics) are impossible to go into this process as we ensure we never know WHO did something. We only know what and when.