An EU delegation agent in a third country must urgently manage a confidential database containing personal information of EU citizens, intended for an international cooperation campaign coordinated by the European External Action Service (EEAS). The agent plans to migrate this database to a cloud computing platform of a third-party provider not established in the European Union to improve remote accessibility. Considering the fundamental principles of the General Data Protection Regulation (GDPR) and the nature of the personal data, which is the most critical compliance measure the agent must ensure before initiating the international data transfer?