Review the company tenant with a written scope — do not export the whole domain to a US e-discovery vendor as a first step.
Company mailboxes are the cleanest documentary source in a PRC investigation if the employee was told the account is for work. Personal Gmail on a company laptop is a harder PIPL/SPI story. Cross-border export of mailboxes is a CBDT problem (live PIPL/CBDT pages). Keyword lists should match the mandate. Do not CC a personal Hotmail ‘so HQ can see’. WeChat remains a separate related guide. Litigation evidence rules are how it later lands in court.
4 questions before you choose the route.
This page identifies the right question and evidence. It does not determine the legal outcome on a reader’s facts.
Which tenant and who was notified?
Work mail vs personal.
ScopeDoes the review leave China?
CBDT overlay.
ExportHold vs collection?
Do not collect the world.
HoldVendor in PRC?
Entrusted processing.
VendorWorking rule: Map the regulated role before marketing or launch in China.
The signal ledger.
These facts move the question beyond a label and into a product, money-flow and control analysis.
Bring a compact evidence docket—not a pitch deck.
Give a compliance team or counsel the operating facts that reveal the perimeter.
Questions people ask before they build.
Short answers for orientation. The right result can change with the service model and current rules.
Can we read an employee’s 163.com?
Usually not without a strong basis. Company tenant first.
Where is CBDT?
Primary authorities
Reviewed sources support orientation, not a fact-specific assessment.