PCI compliance works pretty well.

I would like to see restricted access to only us workers for us citizens data though.

Transferring us customer data outside the country should be illegal

PCI compliance is a joke. That isn't even close to good enough. I'll break all your PCI compliant stuff trivially.