An EU analyst in charge of managing a transnational research project on climate change must share a set of data that includes personally identifiable information from participants in all 27 Member States. The analyst plans to use a cloud computing platform of a non-European provider to store and process these data, ensuring that only authorized team members can access them through two-factor authentication and at-rest encryption. According to the General Data Protection Regulation (GDPR) and the data security principles of the EU, which is the most critical and mandatory security measure that the analyst must implement before transferring the data outside of the European Union to ensure legal compliance, assuming there is no adequacy decision for the provider's country?