Why Does Your Company Secretary Need Your IC and Personal Details? A Plain-English Explainer on What’s Normal

Your company secretary asks for your IC (Identity Card) or passport, your home address, and your phone number because the law requires your company to keep this information on record, and because your secretary cannot submit anything to SSM (Suruhanjaya Syarikat Malaysia, the Companies Commission of Malaysia) without it. This is not a sales tactic or an unusual request. Every Sdn Bhd in Malaysia, regardless of which provider it uses, is required to hold accurate particulars of its directors and shareholders, and to keep that information current. Boss Boleh has incorporated and managed compliance for thousands of Malaysian companies, so this is a question our team answers almost every week from first-time directors who are, understandably, cautious about handing over personal documents online.

🔔 TL;DR

Your company secretary collects your IC/passport, address and contact details because SSM requires accurate director and shareholder records, not as an optional extra.
This data supports your statutory registers, your Annual Return, and Beneficial Owner (BO) reporting to SSM.
A qualified company secretary under Section 235 of the Companies Act 2016 is personally accountable for what is filed, so verifying your identity properly is part of the job.
Your data is also protected: the Personal Data Protection Act 2010 (PDPA) sets rules on consent, security, and retention that any company secretary in Malaysia must follow.
You can check whether a company secretary is properly registered using SSM’s List of Registered Secretaries before you share anything.

📌 What exactly does a company secretary do with your IC and personal details?

A company secretary uses your IC or passport, residential address, and contact details to populate your company’s statutory registers and to prepare documents for submission to SSM. When you incorporate a Sdn Bhd, SSM requires the proposed company name, nature of business, paid-up capital, registered office address, and the full particulars of every director and shareholder, including NRIC or passport numbers and residential addresses. This is not an internal company secretary policy. It is what SSM’s registration system itself asks for, and your secretary is simply the person submitting it on the company’s behalf.

Beyond incorporation, this same information gets reused every year. The Annual Return your company lodges generally within 30 days of its incorporation anniversary must contain the prescribed particulars required by SSM, including details of directors, managers, the company secretary, auditors, and members and their shareholdings. It is not limited to just a few items; it is meant to be a full, current snapshot of the company. If your address or IC details change and nobody updates the register, the Annual Return filed that year could be inaccurate, and inaccurate filings are a bigger headache to fix than updating your details once, early.

📌 Why does the law specifically require this, not just the secretary’s own preference?

Building on the point above, the deeper reason is accountability. Every company incorporated in Malaysia, whether a Sdn Bhd or a Berhad, must appoint at least one qualified company secretary. A qualified company secretary either belongs to a professional body listed in the Fourth Schedule of the Act, such as MAICSA (Malaysian Institute of Chartered Secretaries and Administrators) or MIA (Malaysian Institute of Accountants), or holds a licence issued by SSM. Either way, that person must also register with SSM and hold a valid practising certificate. (Section 235, Companies Act 2016.)

What this means practically: the company secretary’s name is formally attached to the company’s statutory filings. If a secretary submits information about a director or shareholder without verifying it properly, they are putting their own practising certificate on the line, not just doing the company a favour. That is why a legitimate company secretary in Malaysia will insist on seeing your IC or passport directly, rather than accepting a typed name with no supporting document.

Because a company secretary’s name goes on the filings submitted to SSM, they must verify your identity properly before attaching their own professional reputation to the work. This is why the verification step is non-negotiable rather than a formality.

📌 What specific documents and details should you expect to be asked for?

Here is what is standard across Malaysia, whether you incorporate with Boss Boleh or any other qualified company secretary:

NRIC or passport copy: for every director and shareholder, Malaysian or foreign.
Proof of residential address: sometimes a recent utility bill or bank statement, especially for foreign directors.
Contact details: a phone number and email address for communication and for SSM’s records.
Signed consent: acknowledging that your details will be used for company registration and ongoing compliance, including Beneficial Owner (BO) reporting, which identifies the individuals who ultimately own or control the company.
Specimen signature or digital signature setup: used for signing statutory forms and resolutions.

None of this is unique to one provider. If a company secretary asks for less than this, that itself is worth questioning, because it suggests they may not be collecting what SSM actually expects.

📌 Is it normal to submit all of this online, without meeting anyone in person?

Yes, this is increasingly how the process works, and it is a service choice rather than a legal requirement. The Companies Act 2016 does not specify how a secretary must collect your IC or signature; it only requires that the information be accurate and on file. Remote onboarding, eKYC (electronic Know Your Customer identity verification), and digital signatures are simply how providers like Boss Boleh deliver the service, which is particularly useful if you are a foreign founder or a Malaysian based overseas incorporating a company. The underlying legal obligation to hold accurate particulars exists either way; only the delivery method has changed.

📌 What happens to your data once you hand it over?

You should know what protections apply after you submit your documents. Under the Personal Data Protection Act 2010 (PDPA-Personal Data Protection Act), a company secretary handling your IC and address is a data controller and must follow several core principles. These include obtaining your consent before processing the data, telling you why it is being collected, keeping it secure against loss or unauthorised access, not holding it longer than necessary, keeping it accurate, and letting you access or correct your own information. In practice, this means a properly run company secretary firm should have clear consent forms, secure storage, and a process for you to update your details if something changes, such as a house move or a new IC number.

📌 How can you check a company secretary in Malaysia is legitimate before sharing your IC?

Given how much personal information is involved, it is reasonable to verify the person or firm before sending anything. You can check SSM’s List of Registered Secretaries to confirm the individual is properly registered. When speaking to a company secretary in Kuala Lumpur or anywhere else in Malaysia, ask for their name as registered with SSM, their practising certificate number and its validity, and whether they qualify through professional-body membership or an SSM licence. A licensed company secretary in Malaysia should be able to answer all three without hesitation.

📌 Frequently Asked Questions

Do I need to give my IC to a company secretary even if I am a foreigner incorporating in Malaysia?

Yes. Foreign directors and shareholders still need to provide passport details and proof of address. Note that the individual formally appointed as company secretary must still be an eligible Malaysian citizen or permanent resident ordinarily resident in Malaysia, even for a fully foreign-owned Sdn Bhd.

Can I refuse to give my residential address to a company secretary?

Not practically. SSM requires a residential address for every director and shareholder as part of the statutory register, so withholding it means the company cannot be properly registered or kept compliant.

What happens if my IC details change after incorporation?

You should update your company secretary as soon as possible so the company’s register and future Annual Return filings stay accurate.

Is a director allowed to also be the company secretary?

Yes, provided they meet the qualification requirements under Section 235(2) and hold a valid practising certificate. Section 242 only prevents one person acting in both capacities for actions that legally require a director and a secretary to act separately.

What happens if a company has no company secretary at all?

Deadlines for Annual Return and Beneficial Owner reporting keep running regardless. Directors remain responsible for making sure information is collected and filed, and the work becomes harder without a secretary coordinating it.

Does giving my IC to a company secretary mean I lose control over how it’s used?

No. Under the PDPA, you retain rights to access and correct your own personal data, and the company secretary must have obtained your consent before using it.

ABOUT BOSS BOLEH

Boss Boleh is a licensed company secretary and online incorporation platform built for first-time Sdn Bhd owners. Beyond company secretarial work, it also offers a one-stop compliance solution for entrepreneurs, including accounting, tax planning and tax filing services. Our eKYC and digital signature process collects and verifies the same IC and personal details discussed in this article, securely and without a branch visit, while supporting Annual Return and Beneficial Owner submissions to SSM. We serve clients in Kuala Lumpur, every other state in Malaysia, and Malaysians overseas.