How long must our NPO keep donation records — and what can we throw away?

The rule everyone actually needs: 7 years, from the Income Tax Act

The pain is familiar: a storeroom of receipt books going back a decade and a half, carbon copies fading, and nobody quite sure which year's boxes are safe to throw out. Before you touch a single box, know this: the retention duty for your money records doesn't come from your society's constitution or your CLBG's articles — it comes from the Income Tax Act 1967.

Section 82A of the Act requires every person who is required to furnish a return of income for a year of assessment to keep and retain sufficient documents, in safe custody, for a period of 7 years from the end of that year of assessment — and if no return was furnished for a year, the 7 years runs from the end of the year the return is eventually furnished ^[2]. This applies to "every person" — which under the Act includes a body of persons, a company, and an association — not only businesses. Section 82 separately imposes a duty to keep sufficient business records where a person carries on a business ^[1]. LHDN's own Public Ruling on the subject describes "sufficient records" as including invoices, receipts, bank statements, cheque butts, payroll records, vouchers and any other documents necessary to verify the entries in your books of account ^[1]. This is why the answer to "can we throw the box from 2015 away?" only starts with the calendar — it also depends on which year of assessment that box supports, and whether a return for that year has actually been filed.

Practical tips:

• Work out your retention floor from your organisation's own year of assessment, not the calendar year your AGM happens to fall in.
• If a year's return was filed late, or you're not certain it was filed at all, treat that year's 7-year clock as not yet started — don't destroy the underlying records until you've confirmed the filing history with your tax agent.
• Section 82's business record-keeping duty carries its own offence provision (section 119A). The broader section 82A duty that reaches non-business NPOs doesn't carry an equivalent named offence in the Act ^[1][2] — but incomplete records can still leave you unable to substantiate a return under audit, which carries its own consequences.

If you're a company limited by guarantee, there's a second 7-year clock

Many larger charities and foundations register as a company limited by guarantee (CLBG) rather than a society. If that's you, section 245 of the Companies Act 2016 adds its own, separately-worded duty: keep accounting and other records that sufficiently explain your transactions and financial position, make entries within 60 days of the transaction, and retain those records for 7 years from the completion of the transactions or operations to which they relate — kept at your registered office or wherever your directors decide, and open to director inspection at all times ^[3].

In practice this lands on the same 7-year number as the tax rule, just measured from a different starting point. For a CLBG, simply retain 7 years past whichever date is later, rather than trying to split the difference.

Practical tips:

• If your accounting software timestamps entries, check that entries are actually being made within 60 days of the underlying gift — a backlog isn't just messy, it's a compliance point under section 245.
• Keep records at a place your directors have agreed on and can point to if asked — "somewhere in the treasurer's garage" isn't a defensible answer to a director's inspection request.

If you're a society, the position is different — and less clear-cut

This is the point where treasurer turnover causes real damage: a new committee takes over, nobody can say for certain how long the old receipt books need to sit in the cupboard, and the safest-sounding answer ("forever, just in case") is what fills the storeroom.

Here's what the Societies Act 1966 actually says. Every registered society must, within 60 days of its AGM (or, if none is held, within 60 days of the end of the calendar year), forward to the Registrar of Societies its accounts for the last financial year together with a balance sheet ^{[4, s14(1)(d)]}. It must submit its accounts for audit at least once a year ^{[4, s26]}. The Registrar can require a society, in writing, to produce its books of account, membership register and minutes for inspection ^{[4, s27]}. And a society's constitution must provide for "the keeping of accounts of the income and expenditure of the society and the publication of such accounts to its members annually" ^{[4, First Schedule, para 1(j)]}.

What the Act does not do is state a number of years for how long those books of account must be kept. Unlike the Income Tax Act's explicit 7-year clock, or the Companies Act's explicit 7-year clock, the Societies Act imposes an ongoing duty to keep accounts and make them available — but is silent on a retention period once a given year's audit and annual return are done. This isn't a gap this article can responsibly fill with a number of its own; if your society specifically needs ROS's expectations on this point (for example, ahead of a compliance visit), that's a question for the Registrar of Societies directly.

If you go looking for LHDN's own guidance for associations and societies specifically, be careful: Public Ruling 6/2000, which covers "persons other than companies or individuals" (explicitly including clubs and associations), states a retention period of at least six years from the end of the calendar year the accounts are closed — one year short of the Act. That ruling was issued in March 2000 and has never been amended, unlike the equivalent rulings for individuals/partnerships and for companies, both of which were updated in 2001 to state seven years, matching section 82A. The Act itself is the stronger authority and is never in doubt on this point: keep to 7 years, not the stale ruling's six ^[7].

What it means practically: since almost every society with any real income also has a tax filing obligation (whether or not it holds 44(6) approval — see What is s44(6) approval and how do we get it?), the Income Tax Act's 7-year rule under section 82A still reaches you even though your own registration Act is silent on the point. Treat 7 years as your floor regardless of entity type.

Practical tips:

• Don't let "the Societies Act doesn't say" become "we don't need to keep anything" — the tax law's 7-year duty still applies to you.
• If your organisation holds LHDN approval under subsection 44(6), keep your approval letter for as long as you rely on it, plus the 7-year window covering every receipt issued under it (see What is s44(6) approval and how do we get it?).

Can you scan the receipt books and throw away the paper?

For most organisations, yes — with one condition worth checking carefully before you feed anything through a shredder. Section 82(7) of the Income Tax Act itself requires that records kept electronically be retained "in an electronically readable form" and kept in a manner that is "readily accessible and convertible into writing" — and, like all your records, kept in the national language or English and made accessible to LHDN for inspection ^[1].

That's a real condition, not a formality — a folder of low-resolution photos nobody can search, or a proprietary format your scanning app no longer opens, would not meet it. Confirm with LHDN or your tax agent that your specific scanning process satisfies this before you shred originals; this article can give you the principle, not audit your workflow.

One more point worth knowing if your organisation issues e-Invoices: LHDN's e-Invoice Guideline (Version 4.8, 30 August 2026) explicitly reminds taxpayers that even though IRBM stores every validated e-Invoice in its own database, that storage does not replace your own record-keeping duty — "taxpayers are reminded to retain sufficient records and documentation in relation to the transaction" ^{[6, §2.3.7, §2.4.6]}. In other words, LHDN keeping a copy of your e-Invoice is not a reason to stop keeping your own. (Whether your organisation needs to issue e-Invoices for donations at all is a separate question, covered in Do we need an e-Invoice for a donation, or is our LHDN receipt still enough? — the Guideline's general small-taxpayer exemption for annual turnover under RM3,000,000 applies to all categories of taxpayer, NPOs included ^{[6, §1.6.1(e), §1.6.10]}.)

Practical tips:

• Scan at a resolution and in a format your organisation (and, if it ever comes to it, LHDN) can actually read years later — not just what happens to be convenient today.
• Keep the digital file organised by year of assessment, not by donor or campaign, so you can find "everything from YA2019" quickly when a retention decision needs to be made.
• If your gateway or bank offers a downloadable statement, save it in your own archive too — don't rely on a third party to keep your bank records for 7 years on your behalf.

Donor personal data is a different question from financial records

Here's the tension the reader's question points at directly: your financial records must be kept for 7 years, full stop — but the Personal Data Protection Act 2010's Retention Principle says the opposite for personal data in general: "the personal data processed for any purpose shall not be kept longer than is necessary for the fulfilment of that purpose," and a data user has a duty to take all reasonable steps to destroy or permanently delete personal data once it is no longer required for the purpose it was collected ^{[5, s10]}.

These two rules don't actually conflict, once you separate what each one is about. A receipt with a donor's name and amount on it is part of a financial record you have a legal obligation to retain — and PDPA's own General Principle recognises "compliance with any legal obligation" as a basis for processing personal data. The 7-year tax duty is exactly that legal obligation, so it is not overridden by a donor asking you to delete their data mid-way through that window; you can (and should) explain that the receipt itself has to stay for the retention period, even if you stop using their contact details for anything else.

Where the Retention Principle actually bites is data that isn't tied to a retention-mandated record: a mailing-list signup with no donation attached, an old volunteer application, a phone number kept "just in case" long after any receipt window has closed. Review and delete that once its original purpose is served — don't keep it indefinitely by default alongside your financial archive.

A separate 2024 amendment to the PDPA changed several other obligations, with a staged 2025 commencement — the specifics are covered in its own dedicated article. This entry sticks to the Retention Principle itself, which that amendment did not touch.

Practical tips:

• Separate "financial record retention" (7 years, non-negotiable) from "everything else about this person" (delete once the purpose is done) in your own policy — don't apply one blanket rule to both.
• If a donor asks you to delete their data, tell them clearly which parts you can act on immediately and which parts (the receipt itself) are covered by the tax retention duty.
• Collecting MyKad/IC numbers on receipts raises its own PDPA questions, covered separately in Collecting IC numbers from donors.

What this means for your organisation

1. Set your retention floor at 7 years, measured from the end of the relevant year of assessment (or from completion of the transaction, if you're a CLBG) — and don't destroy anything from a year whose tax return you can't confirm was actually filed.
2. Don't assume your registration Act sets the number. If you're a society, the Societies Act itself doesn't specify a retention period for books of account — the Income Tax Act's 7-year rule is what actually governs you.
3. Confirm your scanning process is "readily convertible into a readable format" before shredding originals — check the specifics with LHDN or your tax agent rather than assuming any scan qualifies.
4. Keep your own copies even where a third party (LHDN's MyInvois system, your bank, your gateway) also stores a copy — their storage doesn't discharge your retention duty.
5. Write down two different retention rules, not one: financial records for 7 years regardless of any deletion request, and personal data that isn't part of a financial record deleted once its own purpose is served.
6. If you hold 44(6) approval, keep the approval letter itself for as long as you rely on it, alongside every receipt issued while it was in force.