An extra-EEA transfer is the movement of personal data from the European Economic Area to a country or organization outside it. In privacy and security work, this matters because data protection rules do not stop at the network boundary: once data leaves the EEA, organizations must show that it remains protected under an approved legal basis and appropriate safeguards.
In cyber security, extra-EEA transfers can happen through cloud hosting, remote support tools, backups, managed services, or incident-response workflows. They are also relevant after breaches, when stolen data is exfiltrated to infrastructure outside the EEA. Defenses include transfer impact assessments, encryption, access controls, contractual safeguards, and documented governance proving that the transfer is justified and reviewable. The key risk is not only unauthorized disclosure, but also moving data to environments where legal protection, oversight, or deletion rights may be weaker.