Should we ask donors for their IC number? When it's needed, and how to protect it

Why the receipt form asks for it in the first place

The pain is familiar: a donor puts money in the box, asks for "a proper receipt," and bristles when your volunteer asks for their IC number. It feels intrusive, and nobody at the counter can explain why — so the honest answer is usually "the form says so."

It says so because of subsection 44(6) of the Income Tax Act 1967. If your organisation holds 44(6) approval, the DGIR's current guideline for approved organisations (23 October 2025) requires an official receipt to carry "the donor's name together with their identity card number, passport number and business registration number, and the donor's correspondence address" ^{[1, §4.9(e)]} — and is direct about the consequence: a receipt is "not eligible to be given to a donor who does not provide the information" the guideline requires ^{[1, §5.6]}. This isn't your organisation being cautious; it's the condition your approval runs on.

That requirement only bites when the receipt needs to be tax-deductible. A general acknowledgement — "thank you for your RM50 gift" — carries no such rule.

Practical tips

• Know whether your organisation currently holds active 44(6) approval before you decide what your form should ask for. An expired or never-obtained approval means none of your receipts are tax-deductible, whatever they say.
• Keep the receipt format itself to what your own approval letter specifies — the guideline confirms the letter, not a general template, sets your organisation's exact format ^[1][2].

When you actually need it: five situations, not one

The last two rows surprise a lot of admins. Read on.

e-Invoicing: it depends on whether the donor asks

The pain here is the assumption that e-Invoicing means collecting an ID from every single donor, every single time. It doesn't.

LHDN's e-Invoice Specific Guideline (version 4.9, published 7 September 2026) splits donation transactions into two scenarios ^[3]:

• Scenario 1 — the donor asks for an e-Invoice. A Malaysian donor (MyKad/MyTentera holder) can give their TIN alone, their MyKad number alone, or both — any one option is enough, so you don't need to insist on all of them ^{[3, §3.5.4–3.5.5]}. A non-Malaysian donor (other than a MyPR/MyKAS holder) needs a TIN, with or without a passport number; lacking a TIN, you can use the general public's TIN (EI00000000010) with their passport number instead ^{[3, §3.5.4(b)]}.
• Scenario 2 — nobody asked. Within seven calendar days of month-end, you issue one consolidated e-Invoice for everyone who didn't request an individual one. The guideline's field table has you enter Buyer's Name as "General Public", Buyer's TIN as EI00000000010, and the identification/passport and address fields as "NA" ^{[3, §3.6.11]} — no donor identity data at all.

e-Invoicing on its own is not a reason to collect every donor's IC number up front — only the moment a specific donor asks. Full detail on the wider e-Invoice rules for donations lives in Do we need an e-Invoice for a donation?.

A floor for organisations implementing e-Invoicing. The e-Invoice implementation rules in §4.10 apply to 44(6) organisations that are within the e-Invoicing regime — on the mandatory rollout timeline, or opted in early. For those organisations, the current guideline adds: "Mulai 1 Januari 2026, bagi penerimaan derma atau hadiah wang melebihi RM10,000 dalam satu transaksi, penderma wajib mengemukakan maklumat lengkap seperti yang dinyatakan dalam Lampiran 1, Garis Panduan e-Invois untuk tujuan pelaksanaan e-Invois." — "From 1 January 2026, for a donation or monetary gift exceeding RM10,000 in a single transaction, the donor is obliged to furnish complete information as stated in Appendix 1 of the e-Invoice Guideline, for the purposes of e-Invoice implementation" ^{[1, §4.10(e) Note iii]}. That date has passed as of this review. If your organisation issues e-Invoices for donations, treat any gift over RM10,000 as requiring the details, whether or not the donor asked — though the Specific Guideline's own interim relaxation lets an organisation with turnover up to RM5,000,000 keep consolidating every transaction, this one included, until 31 December 2027, while that relaxation already ended for an organisation above RM5,000,000 and up to RM25,000,000 ^{[3, §16.1–16.2(a)]}, so which rule actually binds you turns on your own turnover band, not on the RM10,000 figure alone. If you're not sure your organisation is in the e-Invoicing regime at all yet, check Do we need an e-Invoice for a donation? first — this floor doesn't tell you that on its own.

Practical tips

• Don't make identity fields mandatory on every donation form "just in case" e-Invoicing comes up — for gifts of RM10,000 and under, ask only when the donor requests one.
• Flag any single donation over RM10,000 for identity capture automatically. Above that line, "the donor didn't ask" is no longer a valid reason to skip it.
• If a donor gives you a MyKad number but no TIN, that's enough for their individual e-Invoice under the current guideline. Don't send them away to get a TIN first.

Donors without a MyKad: passports and business registrations

The pain: a foreign devotee, an expatriate congregant, or a company giving on behalf of its staff — and your form only has a box for "IC number."

Malaysia's identity landscape for a donor record is wider than MyKad. The 44(6) receipt guideline lists NRIC, passport number, or (for a non-individual donor) a business registration number as acceptable identifiers ^{[1, §5.6.1–5.6.2]}. The e-Invoice Specific Guideline additionally recognises MyPR and MyKAS identification numbers alongside passport for non-Malaysian individuals ^{[3, §3.5.4]}. A company's donation should be recorded under its business registration number, kept separate from the personal NRIC of whoever signs the cheque — two different donors for tax purposes even under one name.

Practical tips

• Give your intake form (or your volunteer's paper log) a real "identity type" choice — NRIC, passport, business registration — rather than one field labelled "IC number" that a foreign donor has to awkwardly repurpose.
• Record a company's gift against its business registration number, not the personal IC of the person who handed over the cheque.

A donor refuses to give their IC — what are your options

The pain is real and happens often: a donor is happy to give, but not to hand over their IC number, sometimes because they've been burned by identity fraud before, sometimes on principle.

For a gift of RM10,000 or under, you have a legitimate, non-confrontational answer, because nothing forces a donor to accept a tax-deductible receipt. The 44(6) guideline's "no receipt without complete information" rule ^{[1, §5.6]} cuts both ways: it stops you issuing a tax-deductible receipt without the details, but it doesn't stop the donor giving, and it doesn't stop you acknowledging the gift with an ordinary receipt that carries no identity number and makes no tax claim. The gift is valid either way; only the deduction is conditional on the paperwork. If your organisation issues e-Invoices for donations, that option narrows above RM10,000 in a single transaction: the guideline makes the donor's complete information obligatory for the e-Invoice regardless of what receipt they want ^{[1, §4.10(e) Note iii]}, so a refusal on a gift that size is a conversation to have before you accept it, not after.

The PDPA adds a related obligation once you do ask: its Notice and Choice Principle requires telling the donor, in writing, whether supplying the data is obligatory or voluntary, and the consequence if they don't ^{[4, s7(1)(g)–(h)]}. One sentence on your form — "an identity number is required if you would like a tax-deductible receipt; without it we can still issue a general receipt" — satisfies that notice and answers the donor's actual question.

Practical tips

• Give the counter volunteer a scripted line for this exact moment: "It's only needed if you want the amount deductible from your tax — without it, I can still give you a receipt for your records."
• Never accept a donor's IC that "looks close enough" to move a form along, and never let a volunteer write down someone else's number to satisfy a required field. A wrong or borrowed number on a receipt is worse than no number: it puts a false document in your files and can attach one person's giving history to another person's identity.

Storing it safely once you have it

The pain here is the informal system that grows up around the formal one: a photographed MyKad on a volunteer's phone, an IC column in a shared donor spreadsheet, a WhatsApp group where someone posts "can anyone check this donor's IC" with a photo attached.

One scope note first: the PDPA applies to personal data processed "in respect of commercial transactions" ^{[4, s2(1)]}, a term defined around the supply or exchange of goods or services ^{[4, s4]} — a pure gift sits awkwardly inside that. But the receipt, e-Invoice or ongoing relationship attached to the gift looks more like a service, so treating donor data as covered is the safer, more defensible practice pending a clearer ruling. If your own facts turn on this point, ask your advisor or JPDP rather than relying on this article.

Three of the Act's principles map directly onto the pains above:

• General Principle — s6(3)(c): personal data must be "adequate but not excessive" for the purpose it's collected for ^[4]. An IC number collected to issue a receipt is proportionate; photographing the whole MyKad (which also shows a photo and full address) when you only need the number is collecting more than the purpose needs.
• Security Principle — s9: you must take practical steps to protect personal data against loss, misuse or unauthorised access, having regard to the harm a leak would cause, where the data is stored, and the reliability of the people who can see it ^[4]. A shared spreadsheet that any volunteer can open, or a WhatsApp thread with photos of MyKads sitting in the phones of everyone in the group, does not meet that standard.
• Retention Principle — s10: personal data must not be kept longer than necessary for the purpose it was collected for ^[4]. An IC number kept for an active donor relationship is one thing; the same number sitting in a spreadsheet from a one-off collection five years ago, with no live purpose, is another.

Worth having on hand for a nervous committee member: an IC number on its own is not "sensitive personal data" under the Act, a category limited to health, political opinions, religious or similar beliefs, and offence records ^{[4, s4]}. It's ordinary personal data — the same consent, notice and security handling as any other donor detail, not the Act's stricter regime. (The 2024 amendments touch related ground — biometric data, mandatory breach notification — covered separately in What the 2024 PDPA amendments changed for your NPO.)

Practical tips

• Type the number in rather than photographing the card — a digit string is easier to secure and correct than an image, and it avoids capturing the photo and address you didn't need.
• Move IC confirmations out of general WhatsApp groups and into whatever system holds the donor record.
• Limit who can see identity fields to the people who actually issue receipts or file e-Invoices.

The same donor, two IC numbers

A smaller, entirely practical pain: the same person gives at a temple counter one year and online the next, and ends up as two donor records because the IC was typed with dashes once and without them the second time, or mistyped altogether.

Nothing in PDPA or the tax guidelines governs this — it's a data-quality problem, not a compliance one — but it matters at year-end, when your annual list of donors who gave RM20,000 or more ^{[1, §5.14.1]} needs to reflect one person's total, not two partial ones.

Practical tips

• Pick one format for identity numbers (with or without dashes) and stick to it across every intake channel — paper, counter, and online form.
• Check for a possible duplicate before creating a new donor record from a paper or counter entry, not just when the system flags one on its own.

What this means for your organisation

1. Check your 44(6) status before you decide what your form requires. If you're not currently approved, an IC number buys you nothing for tax purposes.
2. Make identity fields conditional, not blanket — with one floor. Ask for an IC/passport/business registration number when a donor wants a tax-deductible receipt or an individual e-Invoice; if your organisation issues e-Invoices for donations, treat it as compulsory, not conditional, for any single donation over RM10,000 (unless your turnover is at or below RM5,000,000, where the interim relaxation still allows consolidation until 31 Dec 2027 ^{[3, §16.2(a)]}).
3. Give donors the real choice for an e-Invoice. A Malaysian donor's MyKad number is enough on its own; you don't need to also demand a TIN.
4. Have a script for a refusal. Explain the trade-off — no tax deduction without it, but the gift and an ordinary receipt are unaffected — rather than treating the field as compulsory.
5. Tell donors, in writing, whether the field is optional or required, and what happens if they skip it — the PDPA's own Notice and Choice wording is a reasonable script to borrow from.
6. Stop informal copies. Move IC questions and confirmations out of WhatsApp groups and shared spreadsheets and into whatever system is the donor record's one source of truth.
7. Standardise the format and check for duplicates before a paper or counter entry creates a new record for a donor who already has one.