Popper. slow down there chum. If VM are supplying data to its offshore partners, its not leaving the confines of the VM network. They simply supply the VPN connections so that the data can be accessed remotely.
You're way off mate, nothwithstanding your cares for customer security. You provide me with one single piece of evidence where a UK bank was forced to cancel its offshore contracts because of a DPA issue that was breached because a contracted partner viewed customer data as part of their contractual obligations by a secure VPN connection, then I'll agree you may have a point.