Skip to main content
project@netbasejsc.com
Mon–Sat: 9:00–18:15, Sun: closed
91 Nguyen Chi Thanh, Hanoi
Facebook X (Twitter) LinkedIn YouTube

What are you looking for?

Explore our services and discover how we can help you achieve your goals

South Korea software delivery: PIPA, e-Tax Invoice, payments and Korean script

A South Korea-facing release turns on four decisions before a proposal is comparable: how the Personal Information Protection Act and its commission govern consent and resident registration numbers, whether invoices enter the National Tax Service's e-Tax Invoice system, how card and app payments route through a regulated payment gateway, and when Korean-language interfaces are required. Settle these first.

Submit a project Explore custom engineering

Reviewed by Huy Nguyen (David), CEO · Updated 21 Oct 2026 · 11 min read

star

OutsourcingVN is operated by Netbase JSC, so this guide is written by a supplier that would like your project. It sets out what Netbase can evidence for a Korea-facing brief, points to the regulators' own references your advisers should read in full, and names the decisions that stay with you. The guides index lists guides for other markets, and the market index compares the first question each one raises.

Contents

What makes a South Korea-facing build different?

Four design choices come up in almost every Korea-facing brief, and each has a different owner.

  • Data protection under PIPA. The Personal Information Protection Act, as amended on 14 March 2023, sets the lawful bases a controller may rely on, including consent, a contract with the data subject, a legal obligation, or a legitimate interest of the controller that is manifestly superior to the data subject's rights. A resident registration number may be processed only where a statute or regulation specifically requires or permits it, where it is manifestly necessary to protect someone's life, body or property from imminent danger, or in cases the Personal Information Protection Commission has notified, and it must be retained encrypted. A controller must notify affected individuals without delay once it becomes aware personal information has been lost, stolen or divulged, and a cross-border transfer is allowed only on a ground the Act lists, such as the data subject's separate consent, a statute or treaty provision, or a transfer needed to conclude and perform a contract with the data subject that the privacy policy discloses.
  • Card and app payments through a regulated gateway. Card and app payments route through a payment gateway service under the Electronic Financial Transactions Act, and a revision the Financial Services Commission promulgated on 16 December 2025 requires payment gateway services to manage 100 percent of unsettled funds separately and externally from 17 December 2026.
  • The National Tax Service's e-Tax Invoice system. The National Tax Service describes the e-Tax Invoice as an online system for issuing and distributing a tax invoice and transmitting it to the National Tax Service.
  • Korean-language interfaces. Korean text has its own input methods, word spacing and honorific register, and business documents commonly pair it with the Gregorian calendar; none of that is a late translation pass.

Settle each one with your own legal, finance and product owners before discovery starts, and only then should engineering translate the answers into a consent process, an invoicing integration, a payment flow and a language boundary.

What can Netbase evidence for a Korea brief?

Procurement and security reviewers tend to ask for the same statements. These are the ones Netbase can give, set against what a Korea-facing brief actually needs decided.

Decision area What Korean rules and infrastructure expect What a supplier can evidence Who decides
Data protection A lawful basis under PIPA, strict limits on resident registration numbers, breach notice without delay A data processing agreement, an access matrix, a tested breach-response plan Data protection lead
Tax invoicing A structured submission into the National Tax Service's e-Tax Invoice system A tested submission route and a reconciled invoice export Finance systems owner
Payments Card and app payments through a payment gateway operator regulated under the Electronic Financial Transactions Act A tested payment flow with a designed fallback Product owner with payments provider
Language A Korean-language journey with correct Hangul input and rendering in screens and generated documents A named copy owner and a tested translation and rendering workflow Localisation owner
Hosting and contracts A written scope, acceptance test and hosting location that respects your data-protection decisions A written scope with named milestones and acceptance evidence Business sponsor

Security practices include secure code review and version control, role-based access control, MFA for admin dashboards, contributors under NDA, and NDAs and DPAs on request. Netbase clients are in the United States, Europe and Asia-Pacific, and most projects come from clients outside Vietnam. Netbase delivery communication is in English. The Hanoi office works Monday to Saturday, 9:00-18:15 Vietnam time (UTC+7), and support coverage follows those days. Seoul is two hours ahead with no daylight-saving shift on either side, so that day runs 11:00-20:15 Seoul time.

Which steps come before a Korea-facing launch?

  1. Confirm the PIPA lawful basis and breach process

    Work with your advisers to decide the lawful basis for each use of personal data, whether a resident registration number is genuinely needed, and how a breach is reported without delay.

  2. Choose the e-Tax Invoice route

    Decide how invoices reach the National Tax Service's system and who in your organisation owns the submission and the reconciliation that follows it.

  3. Scope the payment gateway integration

    Decide which card and app payment methods the checkout needs, and confirm the gateway operator's regulatory standing under the Electronic Financial Transactions Act.

  4. Scope the Korean-language interface

    Name which journeys need Korean, decide how dates and honorifics display, and who approves Korean copy and checks rendering in generated documents before release.

  5. Decide go-live readiness

    Check the PIPA decisions, the e-Tax Invoice route, the payment flow and the language scope against the plan, and record the decision with its owner.

  6. Launch and keep the record current

    Rehearse the breach-response plan on a schedule, and re-check the e-Tax Invoice and payment-gateway integrations whenever a provider or a rule changes.

Diagram of a Korea-facing launch pipeline: confirm the PIPA lawful basis, choose the e-Tax Invoice route, scope the payment gateway and scope the Korean interface, then decide readiness before launch and keep the record current
Diagram of a Korea-facing launch pipeline

Worked scenario: an e-Tax Invoice correction after issue

An online retailer bills a Korean business customer and issues the invoice through the e-Tax Invoice system, then discovers the quantity on one line is wrong.

  1. Invoice issued

    The billing system creates the invoice and transmits it toward the National Tax Service

    Owner
    Engineering

  2. Buyer notified

    The business buyer receives the invoice through the agreed delivery channel

    Owner
    Buyer's finance team

  3. Error found

    Finance spots the wrong quantity before the transmission deadline closes

    Owner
    Finance systems

  4. Correction issued

    The billing system issues a correction document rather than editing the original record

    Owner
    Engineering with support

  5. Re-transmission

    The correction reaches the National Tax Service inside the system's own timing rules

    Owner
    Finance systems

  6. Record kept

    Both documents are stored together with the project's financial records

    Owner
    Finance systems

A proposal that cannot describe step 4, specifically how a correction is issued once an invoice has already been transmitted, has not yet scoped Korean invoicing for this product.

What has Netbase built that is relevant to a Korea brief?

Netbase has built a web-to-print store for a print business in South Korea, covering custom banners, logos and book covers, as one of a set of stores built on WooCommerce and WordPress with PDF generation for print businesses in several countries; the four-country web-to-print record covers the set. The web-to-print platforms solution sets out how design-tool work like this is scoped.

Which questions should you ask a supplier?

  • Who owns the PIPA lawful-basis decision and breach reporting? It should be your organisation, with the supplier advising rather than deciding for you.
  • Do you actually need to collect a resident registration number, and if so under what legal basis? A supplier that cannot name the basis should not be collecting it.
  • Which e-Tax Invoice route have you actually integrated, and how does a correction work? Ask for a real transmission reference, not a slide.
  • Who holds the payment-gateway merchant relationship after handover? It should be your organisation.
  • How do you test Korean rendering in generated documents? Look for real Korean content, named devices and a defect log, not a placeholder string.
  • What is out of scope for the first release? A good proposal names it rather than leaving it implicit.

What usually goes wrong?

  • A resident registration number collected out of habit. Signal: nobody can name the statute or notified case that permits it. Owner: the data protection lead.
  • The e-Tax Invoice route treated as a one-off form. Signal: the integration cannot issue a correction once a document has transmitted. Owner: the finance systems owner.
  • Payment-gateway compliance assumed rather than checked. Signal: nobody can name which operator processes the funds or how settlement is protected. Owner: the product owner.
  • Korean rendering added as an afterthought. Signal: honorific forms and spacing break in generated PDFs. Owner: the localisation owner.

How this guide is sourced and where it stops

This guide uses the Personal Information Protection Commission's own English pages, the Korea Legislation Research Institute's English translation of the Personal Information Protection Act, the National Tax Service's own e-Tax Invoice page, and the Financial Services Commission's own press release on protecting payment-gateway users' unsettled funds, all accessed on 2026-10-20 or 2026-10-21, together with Netbase delivery records approved in the OutsourcingVN claim register. It is written for product, technology and operations leads preparing a brief. It does not decide whether a specific product sits inside PIPA's scope or which e-Tax Invoice route fits your transaction volume; those decisions stay with your advisers.

Plan the next step for your project

Submit a project Explore custom engineering

Common questions

The Act sets several lawful bases, including consent, a contract with the data subject, a legal obligation and a legitimate interest of the controller that is manifestly superior to the data subject's rights; confirm which basis applies to each use with your advisers.

Only where a statute or regulation specifically requires or permits it, where it is manifestly necessary to protect someone's life, body or property from imminent danger, or in a case the Personal Information Protection Commission has notified, and the number must then be kept encrypted; check the current rules with your advisers before designing a form field around it.

The National Tax Service runs the system as an online issuance, distribution and transmission service; a lower transaction volume may start with a simpler route, while a higher volume usually justifies a direct integration and reconciliation workflow.

The billing system should issue a correction document rather than silently editing the original, and re-transmit it inside the system's own timing rules; ask any supplier to demonstrate this path before launch.

It depends on your audience. Many consumer products ship Korean for the journeys customers use most and keep internal back-office screens in English, provided the boundary is written down and a named owner reviews Korean copy and rendering before release.

Yes, when review and approval rhythms are agreed early: name the Korean-language reviewer, the approval window inside the Seoul working day and the escalation route before the first release.

Plan the first release

Bring your PIPA lawful-basis and breach-reporting decisions, your e-Tax Invoice route, your payment-gateway scope and the names of your legal, finance and product owners. For other Asia-Pacific markets, the Singapore guide covers phased redevelopment and identity data, the Thailand guide covers the PDPA committee and PromptPay, and the Australia guide covers overseas data access and breach-notice timing. Time zone collaboration in Vietnam sets out how an overlap window and escalation route are agreed, and the data security and compliance guide lists the contract questions behind the data protection row.

Custom Product Engineering is the service for a bounded build, and global delivery explains how remote delivery is organised. OutsourcingVN is Netbase's own outsourcing-services platform: submit a project with your registration and payment questions, and a person will reply with whether discovery or a bounded implementation is the right next step.

Custom product engineering for a bounded release outcome Custom product engineering for a bounded release outcome

One defined release of your product, built to named outcomes and handed over with acceptance evidence.

Learn More
line

Sources

91 Nguyen Chi Thanh, Hanoi

+84 937 869 689

Tell us what you want to build or automate.

Submit a project