The issue with cloud data is the same as it is "on prem". You have the same duty to provide the same protections, and typically the difference might be that encryption is applied more often "in the cloud", but one might make the argument that you should be encrypting on premises also. Some laws require it for what is considered high sensitivity data (health data), demographic data, etc.