It's not as if there is no law in space. That'd be a misconception.

But I'm fairly sure where e.g. GDPR or similar are concerned, you can always argue that a geostationary satellite above Europe *is* in Europe. Meanwhile nobody knows what you're actually doing there, or if the data is processed on a geostationary satellite above the, say, USA. Or even on any satellite.

Perfect deniability.