When evaluating cloud computing options, organisations are of course concerned about security issues, as information is hosted elsewhere, often offshore.  Legal aspects are important for  wider security considerations.  But these form only part of the risk/benefit/cost analysis.  Very often the PR damage from a security breach will be more significant than the legal implications.  Further, the risk of security/privacy breach may be lower overall under cloud computing than applies in the status quo (e.g. on-site processing of data), as we outline in our article The Case against Cloud Computing… revisited.    In the article that follows we address the legal aspects of security and privacy for cloud computing.  We use the New Zealand position to illustrate the approach. That approach can be varied to suit issues in other jurisdictions.