True, not everyone obeys the law. Having words in a contract doesn't necessarily change that. And adding more intermediaries into the supply chain could increase the risks. That aside, a large public cloud vendor's standard position will be to recognise the customer owns its data.