>What if I need to send emails? These days doing this ourselves is a dark art by itself (IP/domain address warming up, checking if my domain has not ended on some spam list, etc.).

AFAIK, everyone sending automated emails just uses one of the paid services, like sendmail.

>What if I need to follow some regulations, like European Union GDPR compliance? Have I done everything what is needed to store personal data as GDPR requires? Is my DB password stored in a compliant way or I will face a fine up to 10% of my incomes.

What does this have to do with cloud vs non-cloud? You'll need to manage your data correctly either way.