Regulation is for when businesses cannot regulate themselves.

In many larger companies also, nationstate threats and national security are a trending issue.

If you deal with a lot of PII, outsourcing your data processing pipelines to China isn't going to fly with Congress when you get subpoena'ed for a round with Hawley.