Hard to say exactly what Mastodon does, but mastodon.social's privacy policy should give you some direction in how they handle data: https://mastodon.social/privacy-policy
As mastodon.social is based in Germany, they will know about GDPR and have to follow it to the letter.
That's my take on it as well - GDPR is for the individual instances to deal with, as they're the ones who hold the data on their users and anything coming to them.
The software, of course, can have some design which purges data automatically or whatever, but ultimately the control is whoever is hosting Lemmy so no matter what Lemmy does, people can override it (though some sane defaults are always good, of course).