The proliferation of Internet of Things (IoT) devices has revolutionized various industries by enabling unprecedented connectivity and automation. However, this surge in connected devices has also exposed vast amounts of personal data to potential security breaches, posing significant privacy risks. The General Data Protection Regulation (GDPR) has emerged as a crucial regulatory framework designed to address these concerns, ensuring the protection of personal data across the IoT ecosystem. This article provides an in-depth analysis of how GDPR principles, such as data minimization, user consent, and transparency, are integral to securing IoT devices and networks. It further explores effective data protection strategies, including encryption, anonymization, and the implementation of privacy by design and by default, to help organizations comply with GDPR requirements. Furthermore, it provides a comparative analysis of GDPR and the California Consumer Privacy Act (CCPA) to illustrate differing regulatory impacts on a unified IoT architecture. Through case studies and examples, the article highlights the challenges faced by businesses in achieving compliance, particularly in sectors like e-commerce, healthcare, finance, and smart cities, each of which encounters unique privacy and security challenges. By exploring these complexities, organizations can not only mitigate legal and financial risks but also foster trust and safeguard user privacy in an increasingly interconnected world. Ultimately, this article emphasizes the critical role of GDPR in shaping the future of IoT security and the sustainable development of privacy-centric IoT solutions.