Disabling is what it says on the tin, giving you the chance to re-enable the account later. Nothing GDPR-violating with that. As long as you are also given an option to actually nuke all your PII.

Anonymize data with a restore capability. Maintains historical continuity for never ending total user awareness.