It would improve the next draft to leave the Japanese example for the moment and learn about other countries' approach to the issues you raise, of establishing jurisdiction and assuring compliance. Howe does GDPR work? What about CCPA in California? What does the currently-pending Indian legislation do about making sure that foreign entities collecting personal information have Indian patties who will respond to its court orders? The advantage of studying here is that you can learn to think globally. Because there is mathematically exactly zero chance of international agreements given the differences among the world's dominant societies, it would be well to learn to understand the actual state of global play.