>if you are on US soil (or operating from the US?)
Exactly. Email and nextcloud exist. With a government or a bank's budget, it's not that hard to set these things up locally (i.e., within your jurisdiction). Look at France and Matrix for example. If someone tries to subvert your security measures, that can be taken up as a criminal offence. At least you are not relying on legalese and other agreements to safeguard your interests.
Protected, yes, enforceable, not really. You are talking about a reactive stance where regulation will protect black box systems that you have no control over. That's just not possible. You can, and should, have regulation to protect the weaker classes, but hoping that it is really enough is naive. The whole point of open and federated protocols like email is to avoid lock-in. So if a large government or a bank cannot host email, that's a deficiency that they should remedy first.
Then you aren't aware about India. The Government of India aggressively even revised a law, to get 2+ billion dollars of tax from Vodafone, after Vodafone won the case for not paying it in the Supreme Court of India. [Source: https://thewire.in/business/vodafone-versus-india-bit-intern... ].
Second, while your fears on abuse is valid, but this is how international laws slowly come into being. Each country makes their own laws and when they conflict with each other, they sit, talk and evolve mutually beneficial laws. (Or they fight wars and the winner enforces their laws).
Note that while these laws may seem protectionist, it's goal is to provide even foreign players a legal framework to do business in India.
Exactly. Email and nextcloud exist. With a government or a bank's budget, it's not that hard to set these things up locally (i.e., within your jurisdiction). Look at France and Matrix for example. If someone tries to subvert your security measures, that can be taken up as a criminal offence. At least you are not relying on legalese and other agreements to safeguard your interests.