The General Data Protection Regulations (GDPR) are European Union regulations and can be found here:
European Parliament and Council of European Union (2016) Regulation (EU) 2016/679. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN (Accessed: 2 December 2019).
It is more usual to refer to E.U. regulations as they are enshrined in UK law. In this case the relevant legislation is:
Data Protection Act 2018, c. 12 Available at http://www.legislation.gov.uk/ukpga/2018/12/contents/enacted (Accessed: 2 December 2019).
Both these references are in the Harvard style.