Why my work email is mike@wzklaw.com — not Gmail, not QQ.

I'm often asked this by overseas clients and fellow lawyers. With 15 years in CS before law and 8 years in cross-border practice, I owe an honest answer.

Let me start with a counter-intuitive admission.

A self-hosted email is not more secure than Gmail or Tencent Enterprise Mail. The opposite is closer to the truth: big providers have security teams of thousands. A solo lawyer running their own mail server, even with 2FA, is unlikely to outgun them on raw attack resistance.

So why bother?

Because the real question isn't "will it be hacked." It's: where does the data live, which jurisdiction governs it, and who ultimately controls access?

1. Statutory confidentiality.

China's Lawyers Law imposes a legal duty of confidentiality. When a client email sits on Gmail's US servers or Tencent's domestic data center, the lawyer has no real control over how the provider accesses, scans, or retains it. A custom domain doesn't make data invisible — but it puts the storage location and access rules back in the lawyer's hands.

2. PIPL cross-border data transfer (the decisive reason).

Under China's Personal Information Protection Law, a Chinese lawyer using Gmail to handle Chinese clients' personal data is effectively engaging in cross-border data transfer, because Gmail's servers are offshore. PIPL requires separate consent, a security assessment, or a standard contract for such transfers. Few solo practitioners run that process for every matter.

QQ/163 keep data domestically — so no cross-border issue — but the lawyer still can't restrict the provider's access.

A self-hosted domain on compliant in-country infrastructure sidesteps the PIPL cross-border procedure and restores physical control. This isn't "more secure." It's "more compliant."

3. Client trust.

For overseas clients writing in English, Spanish, or Japanese, mike@wzklaw.com matches the firm's domain and can be cross-checked against the bar registry (credit.acla.org.cn, license 144012510953782). That's the lowest-cost first step in building cross-border trust.

Three practical recommendations for fellow cross-border attorneys:

- Use a custom domain — a few hundred RMB per year
- Enforce SSL/TLS and 2FA — never POP 110 / IMAP 143 in plaintext
- Know where your mail server's data physically resides — it determines your PIPL exposure

One last honest line.

There's no absolute security. Not Gmail, not self-hosted. I made this choice not because I'm "better" — but because as a cross-border lawyer, I want my data-handling path to be fully explainable to clients, and defensible under PIPL, the Lawyers Law, and a foreign client's scrutiny.

That's the entire reason.

If you advise cross-border clients and haven't audited your own email stack, this week is a good time.

#CrossBorderLaw #PIPL #DataCompliance #InternationalLawyer #ChinaLegal

———
Mike Wu, Attorney-at-Law · Guangdong Jinglang Law Firm · License 144012510953782
Cross-border practice · 4 languages (CN/EN/ES/JA)
Site: wzklaw.com/contact.php?source=linkedin · Book consultation: wzklaw.com/contact.php?source=linkedin
Bar verification: credit.acla.org.cn