For companies, they have data loss prevention policies in work-enabled devices, constraining work data to only be possible to download to work-approved (usually from their MDM provider) applications, not possible to export and able to be remote wiped from the device by the company at any point they chose.

For government, storing classified information in the cloud is already a major violation. Even data designated as FOUO requires special considerations (Although AWS GovCloud is a good solution for serving such needs). In a sense, your "private clouds" estimate is already the path that has been taken, as there are many frameworks and requirements that have been created by gov over the past few years in terms of storing certain types of information. Trying to force all cloud providers to abide by them seems like it would be a losing battle as well, and would not be taken lightly by many.