If you can legislate data location then it's better to just legislate access and privacy rights to that data instead of the location.
Forcing data to be stored within borders just makes it harder, more expensive, and more inefficient to serve more customers for no real security benefit. And a company with illegitimate operations isn't going to be following these guidelines anyway.
Forcing data to be stored within borders just makes it harder, more expensive, and more inefficient to serve more customers for no real security benefit. And a company with illegitimate operations isn't going to be following these guidelines anyway.