You will need to check your local security/business policies and any restrictions your funding sources may have on processing data (especially human) in cloud. If your institution has a business agreement with said cloud provider (that is endorsed by appropriate officials and counsel) that meets local security criteria, then it is perfectly fine to do the analysis in the cloud.

Whether it's legal or not depends on the contract you make with your cloud provider surrounding data access. The larger providers like AWS and Google cloud generally are already aware of privacy concerns and have legal agreements in place to meet compliance standards. But there will be country and possibly hospital/university/grant-specific regulations that need to be adhered to, so you would be advised to talk to someone familiar with the local regulations that apply to you specifically.