PCI compliance works pretty well.

I would like to see restricted access to only us workers for us citizens data though.

Transferring us customer data outside the country should be illegal