There are more options than the two you mentioned. Listing a few as more people should remember them. I did get a bit off topic....
- Use huge company to provide service.
- Provide service oneself (, likely with Open Source. )
- Use small or medium company to provide service (, likely with Open Source. )
- Use huge company for things huge company is great with, but keep "crown jewels" of company on internal self provided systems.
- Use a small or medium company to provide a service, and another series of small or medium companies to check on the first company.
- Use a huge company based in a country that is very serious about laws and putting CEOs in prison for wrongful acts.
- Do not do the thing. (Included for completeness.)
- Do the thing not on a computer. (Violation of privacy could result in violation of more serious laws.)
- Use an older technology on a computer.
- Use the huge company to provide service, but ensure the data includes insane things.