A European healthcare organization is migrating patient health records to a cloud service provider. Regulatory requirements mandate that all patient data must be processed and stored within the European Union to comply with GDPR. Which data protection consideration is primarily being addressed?