Home
User Guide
The information contained in this section applies to WebSphere Commerce Version 8. The documentation also applies to all subsequent releases and modifications until otherwise indicated in a newer section.WebSphere Commerce is a single, unified e-commerce platform that offers the ability to do business directly with consumers (B2C), directly with businesses (B2B), and indirectly through channel partners (indirect business models). WebSphere Commerce is designed to be a customizable, scalable, and high availability solution that is built to leverage open standards. It provides easy-to-use tools for business users to centrally manage a cross-channel strategy. Business users can create and manage precision marketing campaigns, promotions, catalog, and merchandising across all sales channels.
Compliance
The following section describes how you can leverage WebSphere Commerce features and functionality to help your site be compliant with different privacy and security standards.
GDPR and WebSphere Commerce
WebSphere Commerce provides documentation and functions that your organization can use to help it on the journey to GDPR readiness. If your store operates within the European Union (EU), sells products or services to those people in the EU, or monitors the behavior of EU data subjects, your site likely needs to be GDPR compliant from May 25, 2018.
Data protection by design and default
Data protection by design and default, in accordance with the GDPR, requires that customer data is encrypted during all communications, internal and external. Enable a Secure Sockets Layer (SSL) connection for data transfer between WebSphere Commerce servers and the database.

User Guide
The information contained in this section applies to WebSphere Commerce Version 8. The documentation also applies to all subsequent releases and modifications until otherwise indicated in a newer section.WebSphere Commerce is a single, unified e-commerce platform that offers the ability to do business directly with consumers (B2C), directly with businesses (B2B), and indirectly through channel partners (indirect business models). WebSphere Commerce is designed to be a customizable, scalable, and high availability solution that is built to leverage open standards. It provides easy-to-use tools for business users to centrally manage a cross-channel strategy. Business users can create and manage precision marketing campaigns, promotions, catalog, and merchandising across all sales channels.
- Planning
  Creating a custom implementation of a WebSphere Commerce store requires a significant amount of planning. From gathering client needs, to deploying the live solution, much work is needed to successfully deploy a custom client store. Use the resources in here to help you plan every phase of store creation.
- Installing
  Review the following sections for information about installing the WebSphere Commerce product, associated maintenance, and WebSphere Commerce enhancements.
- Migrating
  Before you migrate to WebSphere Commerce Version 8.0, review this information to help plan and execute your migration.
- Deploying
  The topics in this section describe how to publish stores to either a test or production environment, and how to deploy customized code.
- Operating
- Integrating
  Topics in the Integrating category highlight the tasks that are commonly performed for using WebSphere Commerce in combination with other products.
- Administering
- Tutorials
  WebSphere Commerce provides many tutorials to help you customize and understand your WebSphere Commerce instance and stores.
- Samples
- Developing
  The topics in the Developing section describe tasks performed by an application developer.
- Compliance
  The following section describes how you can leverage WebSphere Commerce features and functionality to help your site be compliant with different privacy and security standards.
  - GDPR and WebSphere Commerce
    WebSphere Commerce provides documentation and functions that your organization can use to help it on the journey to GDPR readiness. If your store operates within the European Union (EU), sells products or services to those people in the EU, or monitors the behavior of EU data subjects, your site likely needs to be GDPR compliant from May 25, 2018.
    - Privacy and consent
      WebSphere Commerce provides storefront and business user functionality that your site can use to present your privacy information and provide consent management options to your shoppers.
    - Right to access
      Right to access, in accordance with the GDPR, is the right for an individual to access their personal data upon request. To help support this requirement, WebSphere Commerce provides a set of SQL queries. If your site uses custom tables or columns to store personal data, customize the queries as needed. It is your responsibility to define a GDPR-compliant process for handling right to access requests.
    - Right to erasure
      Right to erasure, in accordance with the GDPR, is the right for an individual to require that their personal data is deleted when the individual requests it. To help support this requirement, WebSphere Commerce provides a set of SQL queries. If your site uses custom tables or columns to store personal data, customize the queries as needed. It is your responsibility to define a GDPR-compliant process for handling right to erasure requests.
    - Data protection by design and default
      Data protection by design and default, in accordance with the GDPR, requires that customer data is encrypted during all communications, internal and external. Enable a Secure Sockets Layer (SSL) connection for data transfer between WebSphere Commerce servers and the database.
      - Enabling SSL for database connections
        As you update your site to be General Data Protection Regulation (GDPR) ready, you may need to take additional steps so that customer data is encrypted during all communication, both internal and external. To help encrypt communication, WebSphere Commerce encrypts communications between servers. To secure any data transfer between WebSphere Commerce and your database, set up a Secure Sockets Layer (SSL) connection.
      - Enabling SSL connections between the Search and Store servers
        In order for your site to be GDPR ready, you must ensure that all customer data is encrypted during all communication, both internal and external. To secure any data transfer between store and search servers, set up a Secure Sockets Layer (SSL) connection between them.
      - Enabling SSL for database connections in a development environment
        As you update your site to be General Data Protection Regulation (GDPR) ready, you may need to take additional steps to encrypt customer data during all communication, both internal and external. Typically, your development environment should not include personal data for your shoppers. If circumstances necessitate the use of personal data in the development environment, encrypt the communication between your servers and your database. To protect any data transfer between a server and your database, you can set up a Secure Sockets Layer (SSL) connection.
      - Enabling enhanced audit logging
        If your company needs to maintain an audit history of actions that are completed against your shoppers' personal data, you can enable enhanced audit logging.
  - WebSphere Commerce and the PCI Data Security Standard
    The Payment Card Industry (PCI) Data Security Standard (DSS), developed by the founding payment brands of the PCI Security Standards Council, including American Express, Discover Financial Services, JCB, MasterCard Worldwide, and Visa International, facilitates the global adoption of consistent data security measures.
- Securing
  These topics describe the security features of WebSphere Commerce and how to configure these features.
- Performance
- Troubleshooting

Data protection by design and default

As part of getting your making your site GDPR ready, your site may need to encrypt personal data for your users during any transfer of the data. The General Data Protection Regulation (GDPR) requires that customer data is encrypted during all communications, internal and external.

Your organization is responsible for implementing any appropriate technical or organizational measures to ensure the encryption of personal data during any communication or processing of personal data.