How long does Malaysian law say to keep business records?

Key takeaways

• Accounting records: seven years after the transaction is completed (Companies Act 2016, section 245).
• Income tax records: seven years from the end of the year the income relates to, longer if a return was filed late (Income Tax Act 1967, section 82).
• Sales tax and service tax records: seven years (Royal Malaysian Customs Department).
• Employee registers: at least six years (Employment Act 1955, section 61).
• Personal data: no longer than its purpose needs (Personal Data Protection Act 2010, section 10).
• Your advisers confirm the periods; our Docuflo DMS then applies them, stops early deletion and moves inactive files to lower-cost storage.

How long does Malaysian law say to keep each type of record?

Malaysian law sets retention periods record by record, not one rule for every file. These are the periods confirmed in the official text of each law or the regulator’s own guidance.

The Employment Act 1955 states that it applies to Peninsular Malaysia (later extended to Labuan), so employers in Sabah and Sarawak have their own rule to check.

When do records need to be kept longer than seven years?

The same sources extend the period in these situations.

• A late tax return. The seven years run from the end of the year the return is actually furnished. In the example in the Inland Revenue Board’s (LHDN’s) Public Ruling No. 4/2000 (Revised), records for a year ending 31 March 2002, with the return filed in May 2003, are kept until 31 December 2010.
• A tax appeal. The same ruling says records are retained until an appeal against an assessment is finally determined.
• Long customer relationships in regulated sectors. Bank Negara Malaysia’s six years run from the end of the business relationship, so an old customer file stays in scope while the relationship continues. Its list of reporting institutions includes banks, licensed moneylenders, registered estate agents and, for specified activities, practising accountants and lawyers.
• Public sector records. Government agencies must comply with Arkib Negara retention rules and file classifications, as we set out for the public sector on our government solutions page.

Can a company keep its business records in digital form only?

Largely yes, with conditions. Section 82(7) of the Income Tax Act 1967 says electronic records must be kept in an electronically readable form, readily accessible and convertible into writing. The Customs SST FAQs allow soft or hard copy, in Bahasa Melayu or English, kept in Malaysia unless the Director General permits otherwise.

Two details catch companies out. First, section 82(7) also says records originally kept on paper and later converted to electronic form must be retained in their original form, so scanning tax records does not on its own allow the paper to be shredded. Ask your tax agent or LHDN before destroying originals. Second, section 82(8) requires records relating to a business in Malaysia to be kept and retained in Malaysia, which matters when deciding where cloud files are stored.

E-invoicing does not remove the duty either. LHDN’s e-Invoice Guideline (version 4.6, 7 December 2025) says validated e-invoices are stored in its database, and still reminds taxpayers to retain sufficient records and documentation for each transaction.

Should records be deleted when the retention period ends?

For personal data, the law leans towards deletion. Section 10 of the Personal Data Protection Act 2010 says personal data must not be kept longer than is necessary for the purpose it was processed for, and that all reasonable steps must be taken to destroy or permanently delete it once it is no longer required. Payroll files, staff records and customer identity copies all hold personal data, so keeping everything forever is not a safe default.

Companies usually settle this in a written retention schedule: each record type, its period, the event that starts the clock, who approves disposal, and a hold rule for audits, appeals and disputes. The periods in it are your company’s to set with your company secretary, tax agent or legal adviser.

How does Docuflo apply your retention periods automatically?

We don’t set retention periods for our clients. What our Docuflo document management system (DMS) does is apply the periods your company has set, to every file, without anyone tracking dates by hand. We see retention as more than a compliance function: it helps you meet your retention obligations and also reduce storage costs by moving inactive documents to lower-cost secondary storage.

Meeting retention obligations. In Docuflo you define retention policies by document type, business function, regulatory requirement or record classification. Docuflo calculates each retention period automatically from the document date, the creation date or another trigger you define, and prevents the early deletion of records that must be kept for audit, legal or regulatory purposes. Its audit trail shows that your documented retention and disposal policies were followed.

Reducing storage costs. You can set an auto-archiving schedule for documents that are no longer used often but must still be kept. Docuflo moves them from primary storage to lower-cost secondary or archival storage, so less expensive, high-performance storage is needed for active documents. Storage tiers can follow access frequency, retention requirements and business value.

Keeping history within reach. Archived documents stay searchable in the DMS instead of disappearing from view when they move, so you can retrieve them for audits, investigations, disputes or customer requests. Their metadata, access permissions and audit history are kept across storage tiers, and a document can be restored to primary storage when needed, subject to the archive technology chosen.

In practice, it comes down to five steps:

1. Capture and index documents. Organise documents with searchable metadata for easy retrieval.
2. Apply retention policies. Define retention periods based on document types and business requirements.
3. Archive inactive documents. Move less frequently accessed documents to secondary storage where supported, helping optimise storage costs while preserving access.
4. Control access and track activities. Protect records with access permissions and audit trails.
5. Review before disposal. Retrieve records when needed and review retention requirements before authorised disposal.

Frequently asked questions

Does the seven-year period start from the date on the document?

Not always. Under the Companies Act 2016 the seven years start when the transaction or operation is completed. Under the Income Tax Act 1967 they start at the end of the year the income relates to, or at the end of the year a late return is filed, so the tax period often ends later.

How long must payroll and employee records be kept in Malaysia?

Section 61 of the Employment Act 1955 requires each entry in the employee register to stay available for inspection for at least six years after it is recorded. LHDN also lists payroll records among the supporting documents a company should retain for income tax, so check with your tax agent whether the seven-year tax period applies.

Can we throw away paper invoices after scanning them?

Not automatically. Section 82(7) of the Income Tax Act 1967 says records first kept on paper and later converted to electronic form must also be retained in their original form. Ask your tax agent or LHDN before destroying scanned originals.

Does MyInvois keep our e-invoices for us?

LHDN stores validated e-invoices in IRBM’s database, but its e-Invoice Guideline still reminds taxpayers to retain sufficient records and documentation for each transaction. The seven-year rule for tax records still applies to your own copies.

Can Docuflo decide our retention periods for us?

No. Docuflo applies retention periods; it does not choose them. Your company secretary, tax agent or legal adviser confirms the periods for your company, and Docuflo then calculates each file’s retention date from the document date, the creation date or another trigger you define.

Sources

1. Companies Act 2016, sections 245 and 341
2. Income Tax Act 1967, section 82
3. LHDN Public Ruling No. 4/2000 (Revised)
4. LHDN e-Invoice Guideline 4.6
5. MySST sales tax FAQ and service tax FAQ
6. Employment Act 1955, section 61
7. Bank Negara Malaysia, record keeping and reporting institutions
8. Personal Data Protection Act 2010, section 10

Talk to InfoConnect

We have provided information and content management solutions since 1994, from our head office in Petaling Jaya, Selangor. To talk about document management, workflow or data governance for your organisation, contact our sales team.

Email sales@infoconnect.com.my Call +603-7722 2001 Contact page

Existing customers can reach our support team at support@infoconnect.com.my.