You are a new administrator for the European External Action Service (EEAS). You need to share a sensitive diplomatic report containing personal data of EU citizens with a partner institution in a third country. According to EU digital regulations and the principles of data protection, which of the following actions is the MOST appropriate first step to ensure compliance before the data transfer?