This paper concerns legal aspects regarding data protection related to the outsourcing process achieved by means of cloud computing. The paper examines the effects of European data protection directive on the task distribution between outsourcer and outsourcee in respect of the management of personal information, considering related liability aspects. The author considers the specific regulation of trans-border data flow in the hypothesis of cloud computer services placed outside of EU borders and finally he examines the aspects related to data security.