Why does a charity ask for my IC number — and what are they allowed to do with my details?

Why your receipt asks for an IC number

It isn't your organisation being nosy — it's a condition attached to their own tax approval. If a charity holds approval from LHDN under subsection 44(6), the guideline governing that approval (dated 23 October 2025) requires the receipt to carry "the donor's name together with their identity card number, passport number and business registration number, and the donor's correspondence address" ^[1] — and is direct about what happens without it: a receipt is "not eligible to be given to a donor who does not provide the information" ^[1].

That requirement only applies when the receipt is meant to be tax-deductible. A charity with no 44(6) approval, or a fund its approval doesn't cover, can't issue a tax-deductible receipt regardless of what identity details you hand over.

If you don't have a MyKad, or you're giving as a company, the rules don't require a MyKad specifically: your passport number, or your organisation's business-registration number, is an accepted alternative ^[1].

Practical tips:

• Ask directly whether the receipt is for tax purposes. If it isn't, you shouldn't need to give an identity number at all.

You don't always have to give it

Nothing forces you to hand over your IC number just to make a gift. If you don't want, or don't qualify for, a tax deduction, an organisation can still give you an ordinary receipt as proof of your donation, with no identity number attached ^[1].

The PDPA backs this up. Before an organisation collects your personal data, it's expected to tell you — in writing — whether supplying it is obligatory or voluntary, and what happens if you don't ^[3]. In plain terms: "we only need your IC if you want the tax deduction — without it, you'll still get a receipt for your records."

One reassurance worth having: your IC number isn't treated as extra-sensitive under Malaysian law. The PDPA's stricter "sensitive personal data" category is limited to things like health information, political or religious beliefs, and criminal-offence records — an identification number doesn't fall into it, so it gets the same handling as any other personal detail you might give ^[3].

Practical tips:

• If you'd rather not give your IC, say so and ask for an ordinary receipt — the gift itself is unaffected.

If you're asked for an e-Invoice instead

Some organisations also issue e-Invoices for donations, alongside or instead of a paper receipt. If you specifically ask for an individual e-Invoice, the organisation needs an identity number for it — but you choose which one: your Tax Identification Number (TIN), your MyKad number, or both. Any single option is enough ^[2].

If nobody asks for an individual e-Invoice, gifts of RM10,000 or under for that month are recorded together in one monthly "consolidated" e-Invoice made out to "General Public," with no personal identity details in it at all ^[2].

One floor to know about: for a single donation over RM10,000, an organisation that issues e-Invoices for donations must collect your full details for that e-Invoice from 1 January 2026, whether or not you asked for one ^[1] — though an organisation with turnover of RM5,000,000 or under can still fold it into the anonymous consolidated e-Invoice until 31 December 2027, under a temporary relaxation ^[2].

Practical tips:

• Giving a large single gift over RM10,000 to an organisation that issues e-Invoices? Expect to be asked for your details regardless of whether you request one yourself — that's the rule, not the organisation overreaching.

What the charity has to do with your details once you've given them

Handing over your IC number doesn't give an organisation a free pass to use it however it likes. The PDPA sets out several principles a charity is expected to follow once it holds your personal data ^[3][4]:

• Collect only what's "adequate but not excessive" for the purpose — an IC number to issue a receipt, not a photograph of your whole MyKad (which also shows your photo and address) when only the number is needed ^[3].
• Don't use your details for a new purpose — like a marketing mailing list — without a separate basis, apart from why the data was first collected ^[4].
• Take practical steps to keep your data secure against loss, misuse or unauthorised access ^[3].
• Don't keep your details for longer than the purpose they were collected for still requires ^[3].

Practical tips:

• If a form only mentions "issuing your receipt," a later marketing email from the same organisation is a separate purpose — you're entitled to ask when and why that changed.

Your rights over your own data

Malaysian data protection law also gives you rights over your own information, regardless of why you gave it. JPDP — the Department of Personal Data Protection, Malaysia's regulator for this — states plainly that you have the right to access what an organisation holds on you, ask for it to be corrected, and withdraw your consent ^[5]. You can also tell an organisation, in writing, to stop using your details for direct marketing — and it needs your permission before emailing you marketing in the first place ^[5].

Since 2025, a further right applies regardless of an organisation's size: it must notify you if your data is involved in a breach likely to cause you significant harm — within 7 days of notifying Malaysia's Personal Data Protection Commissioner, who must itself be told within 72 hours of the organisation becoming aware ^[6][7].

Practical tips:

• Getting marketing emails you didn't agree to? Ask the organisation directly to stop, and keep a note of when you asked — a request doesn't always reach whoever sends the next appeal.