Security recordings fall into the category if legitimate need, and have to be deleted after a short while.
How is that enforced?
Its not. Especially when using US Cloud services. And people do that. Hell even government run schools us GDRP-violating software and force the students to BUY them. The law is nice, the reality is different...