Cross-border data transfer is the movement of personal or business data from one country to another. In practice, this can happen when a company sends CRM records, lead forms, event registrations, support tickets, or analytics data to cloud services, overseas offices, or external vendors.
It matters because privacy and security rules often change by jurisdiction. A transfer may require user notice, consent, contractual safeguards, retention limits, or proof that the destination has adequate protections. From a security angle, every transfer adds exposure: misconfigured SaaS apps, weak access control, and poorly reviewed integrations can leak sensitive data across borders. Defenders reduce risk by mapping data flows, encrypting data in transit and at rest, limiting who can access it, reviewing vendors, and separating regional datasets when possible.