Am I allowed to process personal data on a cloud server?
To some extent, the answer depends on location. In the US, IRBs tend to be concerned with Protected Health Information (PHI). There are 18 things that are considered PHI and generally these can be easily stripped from research data. For fMRI and eye tracking data, you need to be a little concerned about two components of PHI

Biometric identifiers, including finger, retinal and voice prints
Full face photographic images and any comparable images

In the UK the term is Personal Data and the definition is:

Personal data means data which relate to a living individual who can be identified –
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller

Most people provide a data storage and archiving plan that outlines how they protect PHI/Personal Data in their IRB ethics application. Most IRBs that I am familiar with do not consider fMRI to be comparable to a full face photograph or allow the individual to be identified. This is despite fMRI researchers often being able to recognize each other's brains. Most eye tracking data that I am familiar with do not include high resolution images of the retina and would not be classified at PHI/Personal Data. People publish pictures of fMRI slices and eye tracking traces all the time. Prior to uploading data onto the cloud, you will want to confirm with your IRB what they consider PHI/Personal Data.