Tiered permissions to generate conditional data access
It isn't too hard to create table-driven access rules if you can base the rules on something that is in the data already, like a country code.

You want to beware the power of multiplication.  Don't try to create access rules based on the cross-product of two or three or more factors.  The management of such a rule set will quickly become impractical due to the shear amount of data. 

Instead, keep each access rule separate (i.e. country, department) and treat each as a gate that the user has to get through before they get access.  This will be a bit of work when setting up your data access code, but it is the best way to operate the system in the long term.