Not being physically located the US, the EU, or any other sovereign territory, they could plausably claim exemption from pretty much any national regulations.
If you run amiss of US (or EU) regulators, they will never say, "well, it's in space, out of our jurisdiction!".
They will make your life hell on Earth.
If you want permissive regulatory environment, just spend the money buying a Mercedes for some politician in a corrupt country, you'll get a lot further...
Which is a good analogy; international waters are far from lawless.
You're still subject to the law of your flag state, just as if you were on their territory. In addition to that, you're subject to everyone's jurisdiction if you commit certain crimes - including piracy. https://en.wikipedia.org/wiki/Universal_jurisdiction
The US government does questionable things to people in places like Guantanamo Bay because the constitution gives those people rights if they set foot on US soil. Data doesn't have rights, and governments have the capability to waive their own laws for things like national security.
Corporations operating in space are bound to the laws of the country the spacecraft belongs to, so there's no difference between a data harbor in Whogivesastan vs. a data harbor on a spacecraft operated by Whogivesastan.