No, #mastoadmin crew, suspending an account does not violate the GDPR, no matter what bad-faith actors might tell you. The GDPR relates specifically to data that can uniquely identify a natural person in the physical world. The only data Mastodon collects that falls under that purview is email address and a combination of latest IP address and latest connection time - and suspending an account doesn't remove that information from the database, although you can do it manually.
(And, as @zatnosk rightly points out, the GDPR (in Article 6 § 1(f)) allows you to delete personally-identifying information if it's in your legitimate interest to do so!)
