A list of countries subjected to GDPR legislation, listed as ISO 3166 Alpha-2 & Alpha-3 codes, converted from the list of Alpha-2, which is why the Alpha-3 ones are not in alphabetical order. See https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes for reference.
This list may not be completely accurate, but, contrary to popular belief, GDPR is not just for EU-countries. While the UK has left the EU, it still keeps GDPR, as well as some (but not all) of certain EU territories like Gibraltar, Reunion, and others. There are also EEA countries like Iceland, Liechtenstein and Norway which are subject to GDPR but not part of the EU.