August 18, 2026

SCAN was recently featured in T21 to discuss its efforts to expand participation among Mexican importers and transportation providers. In the article, SCAN President and CEO Carlos Ochoa highlighted the association’s commitment to strengthening supply chain security throughout North America by opening membership opportunities to qualified Mexican companies. The initiative is designed to help organizations enhance compliance with programs such as CTPAT and OEA, improve visibility into global supply chains, and collaborate with industry leaders to advance trusted trade and security best practices. The expansion reflects SCAN’s vision of building a stronger, more secure North American supply chain network through greater cross-border cooperation and shared security standards.

August 15, 2026

SCAN Association was recently featured in T21 in an article examining how the United States-Mexico-Canada Agreement (USMCA/T-MEC) is contributing to stronger supply chain security across North America. The article highlights SCAN’s perspective that, while USMCA was not designed specifically as a security agreement, its rules of origin, regional content requirements, and verification mechanisms are helping increase traceability, transparency, and accountability throughout the supply chain. These elements support a more secure trade environment and reinforce the importance of trusted trade programs and cross-border collaboration among industry and government partners.

June 15, 2026

Supply chain compliance is rarely simple, particularly when organizations must navigate evolving regulations such as the General Data Protection Regulation (GDPR) alongside varying country-specific requirements. For companies operating across Europe, CCTV retention is one area where compliance expectations can quickly become complex.

To help organizations better understand these requirements, SCAN recently issued a member notice outlining key considerations related to EU CCTV retention policies, GDPR requirements, and Authorized Economic Operator (AEO) expectations.

Download the EU CCTV Retention Policies Infographic (PDF).

Why There Is No Single EU CCTV Retention Standard

One of the most common misconceptions about CCTV retention in Europe is that GDPR establishes a universal retention period. In reality, no single EU-wide standard exists.

Instead, organizations are expected to determine appropriate retention periods based on factors such as necessity, proportionality, risk, and legitimate business needs. As a result, retention practices can vary significantly between countries, making it essential for organizations to understand the specific requirements that apply to their operations.

For businesses with facilities, suppliers, or partners located across multiple jurisdictions, a one-size-fits-all approach may create unnecessary compliance risks.

Key GDPR Principles for CCTV Compliance

Although retention periods differ by country, GDPR provides a consistent set of principles that organizations should follow when managing CCTV footage.

Organizations should:

Establish a legitimate purpose for CCTV monitoring.
Retain footage only for as long as necessary.
Document retention periods and business justifications.
Protect footage through appropriate security measures.
Restrict access to authorized personnel.
Delete footage when retention periods expire.

These principles help ensure that surveillance programs support operational and security objectives while respecting privacy requirements.

Understanding AEO Considerations

For organizations involved in international trade, AEO requirements introduce additional considerations.

AEO programs often expect organizations to maintain effective CCTV coverage, active monitoring practices, secure storage, documented procedures, and the ability to provide footage during investigations or customs audits when required.

However, AEO expectations do not override GDPR obligations. Any retention period must remain justified, documented, and aligned with applicable privacy requirements. Organizations should ensure that security objectives and data protection principles are considered together when developing CCTV policies.

What Organizations Should Do Next

As regulatory expectations continue to evolve, organizations should take a proactive approach to CCTV compliance.

Key actions include:

Review country-specific retention requirements for all relevant locations.
Document the rationale behind retention periods and related policies.
Align legal, compliance, and security teams on retention decisions.
Ensure CCTV programs support audit, investigation, and security requirements.
Regularly review policies to address regulatory changes and emerging risks.

A well-documented and consistently applied retention strategy can help reduce compliance risk while supporting broader business and security objectives.

Compliance Requires More Than Audits

At SCAN, compliance goes beyond identifying gaps. Organizations also need practical guidance to navigate complex regulations and implement effective solutions.

In addition to auditing business partners, identifying compliance gaps, managing corrective actions, and providing ongoing monitoring and tracking, SCAN helps members address evolving regulatory challenges through actionable insights and industry expertise.

As CCTV retention requirements continue to develop across Europe, staying informed and maintaining clear, well-supported policies can help organizations achieve both compliance and operational resilience.

7 May 2026

By Carlos E. Ochoa, Executive Director, SCAN Association

Sharing this post from the latest edition of T21 – a leading specialized media outlet in Mexico focusing on the logistics, transportation, and foreign trade sectors, providing in-depth analysis of industry trends.

In today’s environment of geopolitical tension, supply‑chain reconfiguration, and heightened regulatory scrutiny, trust has become the most valuable currency in North American trade. For the U.S.–Mexico partnership to remain strong, security can no longer be viewed as a cost or a box‑checking exercise. It is a strategic enabler of commerce.

From the U.S. perspective, trade flows efficiently only when governments can trust that supply‑chain actors operate under robust, verifiable security standards. That is precisely the logic behind programs like CTPAT and OEA: identifying low‑risk partners so trade can move faster, not slower.
This is where SCAN (Supplier Compliance Audit Network) adds tangible value to the USMCA framework.

SCAN operationalizes trust. It connects importers already certified by the U.S. and Canadian governments with suppliers that are independently audited under globally recognized security standards aligned with CTPAT, OEA, and the WCO SAFE Framework. By doing so, SCAN translates government‑to‑government trust into factory‑level, importer‑level, and supply‑chain‑level confidence.

For governments, this means:

Greater visibility and consistency across shared supply chains
Independent, credible evidence of compliance beyond country‑level recognition

Reduced risk without creating friction for legitimate trade
For the USMCA, it means transforming security into facilitation—supporting nearshoring, regional integration, and resilience while preserving strong enforcement.

The equation is simple but powerful:
Security enables trust. Trust enables facilitation. Facilitation sustains USMCA.

In a world where trust moves trade, supply‑chain security is the common language—and initiatives like SCAN help ensure both governments are speaking it with confidence.

Security and trust: the invisible architecture that underpins the USMCA – T21