Pump motors
680.21(C): the pool pump motor is GFCI-protected — cord-and-plug or hard-wired, 120 V or 240 V — since the 2020 edition for all pump motors, and for cord-connected pumps in 15/20 A receptacles well before that. A hard-wired pump means a two-pole GFCI breaker (breakers vs receptacles).
Receptacles
680.22(A): at least one receptacle 6 to 20 ft from the water's edge for a permanent pool; every 125 V, 15 and 20 A receptacle within 20 ft is GFCI-protected; nothing closer than 6 ft except the pump receptacle with its own rules. Weather-resistant devices under in-use covers.
Lighting
Underwater luminaires above the low-voltage contact limit (15 V AC / 30 V DC) are GFCI-protected (680.23); low-voltage LED systems fed from listed transformers are the modern way around it. Luminaires within 5 ft horizontally and 5 ft above the water are protected too (680.22(B)).
Spas and hot tubs
680.44: the spa's equipment is GFCI-protected unless it is listed with its own integral protection; a cord-connected spa pack on a 120 V receptacle uses the receptacle or an in-line device; a hard-wired 240 V pack uses a two-pole breaker or the disconnect's built-in GFCI.
Bonding is the other half
Article 680 spends as many words on the equipotential bonding grid — the copper that ties the pool shell, the deck, the rails and the pump together — as on GFCIs. The GFCI trips on a fault; bonding keeps every surface a person touches at the same potential so there is less fault to trip on. One without the other is half a system.