A project manager at the European External Action Service (EEAS) is leading a cross-border initiative to digitize diplomatic reporting. The project involves processing sensitive personal data of EU citizens and third-country nationals, storing it in a cloud environment, and using an AI-based tool to draft initial summaries. To ensure compliance with EU digital regulations and the EEAS's mandate, which of the following actions best aligns with the core principles of the General Data Protection Regulation (GDPR) regarding the processing of personal data in a cloud context?