According to article 18 of the GDPR, The data subject shall have the right to obtain from the controller restriction of processing where one of the circumstances described in this article applies (namely: the accuracy of their data is contested; the processing is unlawful and the data subject opposed erasure of their personal data; the controller no longer needs the personal data, but is required to store it; or the data subject otherwise objects to the processing.

Since different joint controllers, processors or subprocessors might be involved in processing in the case of IoT, it might be good to keep in mind that this right shall be exercised through any of them, who should inform the rest about the requirement and proceed accordingly.