If it chooses to move that data elsewhere, that is its choice, and also liability if moving that data runs afoul of regulations in the original country. The foreign country itself doesn't really matter, the entity is doing business in the original country, and would be held liable there by its users/business partners according to local laws.

>The foreign country itself doesn't really matter

Of course it matters. Every country has legal differences on the definition of privacy and associated liabilities (if there any at all). In addition, it's unlikely that one country can establish jurisdiction over data in a foreign country without violating national sovereignty. Arguing that doing business establishes a legal nexus with someone of a particular citizenship opens up a massive can of worms about whose law applies where.

Data is generated in the location where a human user interacts with the system, whether that be with a fully local system, some random website with a server in who-knows-where, or just configuring a domain for e-mail.

(Yes, AI actions are a separate can of worms.)

> > The foreign country itself doesn't really matter

> Of course it matters.

It doesn't for suing for rights, that's the point of generation-based legal authority. The legal transaction is taking place in the user's location, and by offering services there, you are agreeing to the local legal framework.

> Arguing that doing business establishes a legal nexus with someone of a particular citizenship opens up a massive can of worms about whose law applies where.

This is already the case, except with location and not citizenship. Safe harbor agreements just used to make this much less of an issue until they disappeared. You really can't expect to do business somewhere without adhering to the local legal framework.