>Also, how would the government patrol this without having access to all companies databases, servers, and policies?

As in many other cases you assume the companies are not doing illegal stuff and you act when someone reports them. A developer that is asked to do something illegal like hiding something from the exported data can report it .