Under current privacy law the firm or organization that is storing user data is responsible for data breaches and will pay any fines or damages that are the result of legal action.
The actual data holder—an organization that provides cloud storage—is not usually legally implicated or held responsible in litigation.