This is a very difficult question to answer for an individual set of circumstances. The main issue is that the responsibility for compliance with the law is yours.
In relation to personal data you are a data controller as defined by the Data Protection Act. You can outsource data processing to a third party but you will need a written contract in place to safeguard your client confidentiality (and it is also a legal requirement).
(If you would like your terms and conditions reviewed please get in touch for a no obligation quote.)