This is more a basic result of just not having control of the server side stack. No amount of regulation is going to fix that. You have any number of laws, which can be undermined with a change of a bool by the vendor, and you can't do anything about it. If a government needs basic infrastructure like email, just do it in house. It isn't that hard.
That's software-as-a-service in a nutshell for you. Even if you opt to setup your own server, and develop a custom solution, the US government has the right to ask you to install black boxes on your network and or data centers (read about Lavabit shutting down because of this), if you are on US soil (or operating from the US?).
> No amount of regulation is going to fix that.
I disagree.
Exactly. Email and nextcloud exist. With a government or a bank's budget, it's not that hard to set these things up locally (i.e., within your jurisdiction). Look at France and Matrix for example. If someone tries to subvert your security measures, that can be taken up as a criminal offence. At least you are not relying on legalese and other agreements to safeguard your interests.
In a democracy, our rights are protected by the legal system. So your argument that it is all about "setting up your own system" is specious.
Then you aren't aware about India. The Government of India aggressively even revised a law, to get 2+ billion dollars of tax from Vodafone, after Vodafone won the case for not paying it in the Supreme Court of India. [Source: https://thewire.in/business/vodafone-versus-india-bit-intern... ].
Second, while your fears on abuse is valid, but this is how international laws slowly come into being. Each country makes their own laws and when they conflict with each other, they sit, talk and evolve mutually beneficial laws. (Or they fight wars and the winner enforces their laws).
Note that while these laws may seem protectionist, it's goal is to provide even foreign players a legal framework to do business in India.
> An investigation by the Reserve Bank of India (RBI) has revealed that Microsoft has been passing user data that it gathers from Indian banks that are Office 365 customers to various U.S. intelligence agencies, upon demand ... Microsoft is bound to share customers’ data under US Foreign Intelligence Surveillance Act (FISA) and US national security letters as and when required by the US authorities.”
> ... In the Office 365 contract, the banks agreed to share such data only if it was sanctioned by the Government of India or an Indian court. The contract also made provisions for gag orders issued by the U.S. agencies, where Microsoft wouldn't be allowed to outwardly acknowledge the disclosure of the user data ...
Source: "Microsoft has been sharing Indian bank customers' data with U.S. intelligence agencies" - https://www.neowin.net/news/microsoft-has-been-sharing-india...
Again, this highlights one of the obvious dangers of using a "cloud service" - foreign governments and companies can access your data.