In Japan, where the laws are different from the United States but not in a very material fashion, the personal information privacy law means you have to treat anything with "personally identifiable information" as toxic and anything regarding a few types of enumerated data as nuclear waste.

Your students' names or email addresses are toxic. (Do you offer them blogs? Do they have commenting features? Tied to email? Toxic!)

Their grades, counseling reports, religious affiliation (do I have to explain what kind of universities need this info?), etc, are nuclear waste.

Just because something is in the cloud doesn't make it illegal, but (to pick one example of many) it is going to make that biannual in-person inspection of your facilities they're going to demand a wee bit tricky now won't it. You can argue until you're blue in the face that Google knows what they're doing regarding physical security and that the university stores equivalent data in servers that are in unlocked rooms in a building housing 1,000 transients, but you will not prevail in that argument.

In Canada it is illegal to store student information on servers outside of Canada. At least that is what I was told when I was asked to create a CMS.

Grades, and almost any student info in general.

Come on, if you've spent any amount of time in the education industry you know this.