Legal? Sure. If you mean safe in regards to data protection - it depends on what's put in place. Unless people are using specific software than I doubt it. It would probably be lacking encryption, password protection, backup and protection of those backups etc.