Your IC Number, Their Database: What Subscriptions and Memberships Should and Should Not Ask For

You have probably seen this form

You sign up for a gym, a café rewards app or a mall membership, and the form asks for your IC number. Then your full address. Then your date of birth. You fill it in, because everyone else does.

Now ask a simple question: what does a coffee loyalty app need my IC number for? Usually, nothing. And every extra field is one more thing that can leak, be sold or be misused.

This guide is for both sides of that form: customers who want to protect their data, and businesses that want customer data they can actually use without the risk.

When your IC really is needed

Some businesses must collect your IC by law. Banks and online banks have to verify every customer under anti-money laundering rules. E-wallets such as GrabPay, ShopeePay and Touch 'n Go eWallet need it before you can use their full features. Mobile lines, insurers and investment platforms also need to know exactly who you are.

For most other businesses, there is no such rule. A building guard, for example, has no right to keep or scan your MyKad, the National Registration Department said in 2025, and any processing of personal data by private companies falls under the Personal Data Protection Act.

"It's for the e-invoice"

Since e-invoicing started, many customers have heard a new reason for handing over their IC: "it's for the e-invoice." Sometimes that is true. Often it is not.

For most everyday purchases you do not need an e-invoice in your name at all, and the seller can cover those sales with a consolidated e-invoice, without any of your personal details. Your details are only needed when you ask for an e-invoice in your own name, for example to claim tax relief. Then the invoice must carry your name, tax number or MyKad number, address and phone, and you will usually give an email so it can be sent to you.

Either way, e-invoicing is never a reason to collect an IC number when someone joins a membership or subscribes to a newsletter. And details collected for an e-invoice should be used for that invoice, not copied into a marketing list.

What the law expects from businesses

Malaysia's Personal Data Protection Act was updated in 2024, and the changes came into force in stages during 2025. For any business that runs subscriptions, memberships or marketing lists, a few points matter most:

Indonesia's Personal Data Protection Law has been fully in force since October 2024, with fines of up to 2% of annual revenue. If you serve customers in both countries, design for both.

What a subscription or membership form should ask for

The best forms collect less, not more. Here is what that looks like for a typical rewards membership.

What should never be in a subscription list

Keep less, protect what you keep

Customer data is only useful if customers trust you with it. The businesses getting this right keep a single record per customer, store consent with proof of when and how it was given, mask sensitive fields so staff only see what their role needs, and delete inactive data on a schedule.

On Salesforce, that means a consent and preference centre in Marketing Cloud or Account Engagement, consent stored on the customer profile in Data 360, field-level security so each team sees only what it needs, and Shield encryption and data masking for the few fields that must be protected, including in test copies of your data.

For customers: five habits that protect you

For businesses: where to start

How Telcowin helps

Telcowin has delivered Salesforce projects in Malaysia and Indonesia since 2012, and our delivery is ISO 9001 certified. On every project that touches customer data, we consult from two starting points: the local laws that apply to you, and the rules of your industry regulator.

That means designing against the PDPA and its 2024 amendments, the Personal Data Protection Commissioner's guidelines on data protection officers, breach notification, impact assessments and data protection by design, LHDN's e-invoicing rules where invoices are involved, and Indonesia's PDP Law for regional clients. Then we add your industry's own rules: Bank Negara Malaysia's technology risk requirements for banks and insurers, the Securities Commission's guidelines for capital markets, MCMC rules for telcos, OJK rules for financial services in Indonesia, and PCI DSS wherever card payments are involved.

We do not replace your lawyers or your DPO. We make sure the systems they rely on actually do what the policy says.

Govern it end to end, with Boomi

Fixing one form is a start. The harder problem is everything already out there: customer data copied into spreadsheets, old systems nobody switched off, and integrations moving personal data between apps every minute. Privacy only holds if it is governed across all of them.

Boomi sits between your systems, which makes it the natural place to govern the data flowing through them. It can identify sensitive data across sources such as Salesforce, databases, files and spreadsheets. Boomi Data Hub builds a single golden record for each customer, with role-based access, masking, tagging and an audit trail. Row- and column-level masking and data lineage help teams use data for reporting and AI without exposing what they should not see.

The result is data you can stand behind when a customer asks what you hold, when the Commissioner asks how you protect it, and when your AI tools need data they can safely use. See how Telcowin works with Boomi.