That's a dangerous oversimplification. Standard best practices like logging server traffic with IP addresses, or making immutable backups with no way to edit that data now have serious problems. It's ridiculous to call them "unethical", and it has nothing to do with business models.

Alternatively, some part of your business has spent the last X months preparing for this so that their business won't be affected dramatically.

I am easily tracked to my place of employment so I don't want to get into too many details, but we were doing things ethically but still had a non-trivial amount of going through, dotting our i's and crossing our t's, making sure that there weren't pockets of unknown data, putting together plans in case someone asked for data retrieval or deletion, etc.

The longer a company's been in business, the more onerous the task is. I can't imagine what it would be like for a large company with mainframes still around.

If this is the case, then being transparent about it is a good policy. I hope your employer is committing to compliance publicly and apologizing to its customers for the delay.

We don’t have a delay in our case.