A European Union delegation official in a third country is preparing a confidential report on a new diplomatic crisis. The report contains personal data of EU citizens being analyzed by an external team of experts working in the cloud (third-party services). According to the principles of the GDPR and the EU's guidelines on sensitive data processing, what is the most critical measure this official should implement before sharing the data with the external team to ensure information protection?