Every HR team has it: the drawer (or shared folder) stuffed with payslips, contracts, MC, leave forms and EPF statements going back years. Then the question hits — can we throw any of this out yet? In Malaysia, the answer isn’t a guess. Several laws set minimum retention periods for employment and payroll records, and keeping the wrong things for the wrong length of time can mean a fine during an audit, or no evidence when a dispute lands at the Labour Court. This guide sets out exactly what to keep, for how long, and when it’s safe to dispose of it.

Record-Keeping Is a Legal Duty, Not Housekeeping

Keeping employee records isn’t optional good practice — it’s written into the law. At least four different frameworks require it:

• The Employment Act 1955 requires a register of employees.
• The EPF Act 1991 requires wage and contribution records.
• The Income Tax Act 1967 requires sufficient records to support tax filings.
• The Personal Data Protection Act 2010 (PDPA) governs how long you may keep personal data — and when you must dispose of it.

The tricky part is that these laws set different periods. Here’s how they line up.

The Statutory Retention Periods

Record	Law	Minimum retention
Register of employees	Employment Act 1955 (s.61)	6 years
Wage & EPF records	EPF Act 1991 (s.42(2))	6 years from the last entry
Tax & payroll records (EA, Form E, CP8D, PCB)	Income Tax Act 1967 (s.82 / 82A)	7 years
SOCSO / EIS contribution records	Employees’ Social Security Act 1969	Keep in line with the above (commonly 7 years)

The simple rule: because the longest statutory period is 7 years, the cleanest policy for most SMEs is to keep all HR and payroll records for 7 years — then dispose of them securely. One period, one policy, and you’re covered across every law above. (Note: the Employment Act applies to Peninsular Malaysia and Labuan; employers in Sabah and Sarawak should also check their state Labour Ordinances.)

What Documents Must You Keep?

“Records” is broader than most people think. Group them like this:

• Employee register & personal records — name, IC/passport, address, designation, date of hire, wage rate, and the other particulars prescribed under the Employment Regulations 1957.
• Payroll & wage records — payslips, payroll registers, salary computations, overtime, allowances and deductions.
• Statutory contribution records — EPF, SOCSO, EIS and PCB (MTD) submissions and payment receipts.
• Tax documents — Form E, CP8D, EA forms, CP22 / CP22A and TP forms.
• Attendance & leave records — time/attendance data, leave applications, medical certificates and overtime approvals.
• Contracts & employment letters — offer letters and contracts, confirmation, promotion and transfer letters, warning and show-cause letters, domestic inquiry notes, and resignation or termination letters.
• Foreign worker documents — permits (PLKS), levy receipts and FOMEMA records, for as long as the worker is employed and the periods above after.

A good test: if a document affects someone’s pay, tax, statutory contributions or employment status, it’s a record you keep.

The PDPA Flip Side: Don’t Keep It Forever

Here’s the part employers often miss. The PDPA’s Retention Principle (Section 10) says personal data must not be kept longer than is necessary for the purpose it was collected. So you can’t just hoard every file indefinitely “to be safe.”

The two rules aren’t in conflict — they bookend each other. Meeting a legal obligation (tax, EPF, labour law) is a legitimate reason to keep data, so retaining records for the statutory 7 years is fine. But once that period passes and there’s no live dispute, audit or claim attached to a file, you should securely destroy or anonymise it rather than leave personal data lying around. Keeping it “just in case” after it’s no longer needed is itself a PDPA risk.

One Exception: Open Matters

Retention periods are minimums, not deadlines to shred. If a record is tied to an ongoing or anticipated matter — a tax query, an Industrial Court claim, an insurance claim, a reference request — keep it until that matter is fully closed, even if the 7 years have passed. A dismissed employee has 60 days to bring a Section 20 claim, and contract-based claims can surface for up to six years, so disciplinary and termination files earn their keep.

Paper or Digital?

Electronic records are accepted, provided they are complete, legible and retrievable on request. Digitising HR files is usually the smarter route: it survives floods and lost drawers, makes an audit a search instead of a scramble, and lets you apply proper access controls — which the PDPA also expects. The key is that whatever format you choose, the records must be produceable when the Labour Department, LHDN, EPF or SOCSO asks.

A Simple Retention Policy for SMEs

• Set one retention period — 7 years — for HR and payroll records, measured from the last entry or the end of the relevant year of assessment.
• Keep records in a searchable, access-controlled system, not loose files.
• Tag any file linked to a live dispute, audit or claim so it isn’t deleted on schedule.
• Securely dispose of records once the period lapses and no matter is open — don’t keep personal data indefinitely.
• Review the policy annually against the latest compliance requirements.

How Pandahrms Helps

Record-keeping is painful on paper and easy in a system. Pandahrms keeps each employee’s records — payslips, statutory submissions, leave and attendance, contracts and letters — in one secure, searchable place, with the contribution and tax documents generated and stored as you run payroll. When an audit or a dispute comes, the file is a search away instead of a drawer-by-drawer hunt, and access is controlled the way the PDPA expects. For the wider picture of what falls due, see our HR & payroll compliance checklist.

Frequently Asked Questions (FAQ)

1. How long must I keep HR and payroll records in Malaysia?
   The minimums vary by law: the employee register is 6 years (Employment Act 1955), wage and EPF records 6 years from the last entry (EPF Act 1991), and tax-related records 7 years (Income Tax Act 1967). Because 7 years is the longest, keeping everything for 7 years is the simplest safe policy.
2. Which records do I actually need to keep?
   The employee register and personal records, payslips and payroll computations, EPF/SOCSO/EIS/PCB submissions and receipts, tax documents (EA, Form E, CP8D, CP22/CP22A, TP forms), attendance and leave records, employment contracts and letters, and foreign-worker permits and levy records.
3. Can I keep records electronically?
   Yes. Electronic records are accepted as long as they are complete, legible and can be produced when the authorities ask. Digital storage also makes access control and retrieval easier.
4. Does the PDPA mean I should delete records sooner?
   The PDPA’s Retention Principle says personal data must not be kept longer than necessary. Meeting a legal retention duty is a necessary purpose, so keeping records for the statutory 7 years is fine — but once that period passes and no matter is open, you should securely destroy or anonymise them.
5. When does the retention clock start?
   Generally from the last entry in the record (for the employee register and EPF wage records) or the end of the relevant year of assessment (for tax records). For a departed employee, count from when their records were last updated.
6. What if a record relates to an ongoing dispute?
   Keep it until the matter is fully resolved, even beyond 7 years. A Section 20 unfair-dismissal claim can be filed within 60 days of dismissal, and contract claims can arise for up to six years, so keep anything tied to a live or likely dispute.

Source: Employment Act 1955 (Section 61 and the Employment Regulations 1957) on the register of employees; Employees Provident Fund Act 1991 (Section 42(2)) on keeping wage and EPF records for at least six years; Income Tax Act 1967 (Sections 82 / 82A) on keeping sufficient records for seven years; the Employees’ Social Security Act 1969 for SOCSO/EIS records; and the Personal Data Protection Act 2010 (Section 10, Retention Principle). Retention periods are statutory minimums and the start point can vary by record — the Employment Act applies to Peninsular Malaysia and Labuan, with separate Labour Ordinances in Sabah and Sarawak. This article is general information, not legal advice — confirm your specific obligations with the Labour Department, LHDN, EPF, SOCSO or a professional adviser.