Do not underestimate the government factor.

When you have your systems, you are responsible to the territory you operate in. Cloud providers (where you have no idea where information is kept) can be targeted by a whatever governments they, or their facilities are beholden to. Not comforting.

Even within the US, how much commitment is there? ATT & other phone companies rolled right over when the US government illegally asked for private phone records, they certainly had no enthusiasm to challenge illegal requests. When you control your data, your legal department can determine if challenges need to be made.