Barbados does not have a stand-alone anti-spam statute along the lines of the US CAN-SPAM Act. Instead, commercial email and text messages that use people’s personal data fall under the Data Protection Act, 2019–29, a GDPR-style privacy law. It was passed in August 2019 and became enforceable on 31 March 2021, apart from the provisions on registering data controllers and processors. It is supervised by the Data Protection Commissioner.
If you run a hotel on the west coast, a Bridgetown accounting firm, a rum-shop brand with an online store, or a corporate-services provider in the international business sector, this page explains in plain language what the Act means for your mailing list. It is general information, not legal advice. For a decision about your own business, speak to a Barbadian attorney.
Why an email address counts as personal data
The Act applies to the processing of personal data about living individuals. A name, an email address such as [email protected], a mobile number starting +1-246, a purchase history or a click record from a newsletter are all personal data. Once you collect, store, segment or send to them, you are a data controller with duties under the Act. Your email platform acts as your data processor.
The Act follows the European model closely. If you already know the principles of the GDPR, most of the vocabulary will be familiar: lawful basis, transparency, purpose limitation, data minimisation, accuracy, storage limitation and security.
The four rules that matter most for marketers
1. Have a lawful basis, and in practice that usually means consent
Processing is lawful only when one of the conditions in the Act applies. For promotional email, the cleanest condition is the person’s consent, which the Act defines as a freely given, specific, informed and unambiguous indication of the person’s wishes, given by a statement or a clear affirmative action. A pre-ticked box, or a line in your terms and conditions, is hard to defend under that definition. Legitimate interests exist as a basis, but they are weighed against the rights of the individual. For cold marketing they are a much weaker footing than consent. Our page on permission to send email campaigns in Barbados goes through how to collect and record it.
2. Respect the right to stop direct marketing
The Act gives every individual a specific right to stop their data being used for direct marketing. It defines direct marketing broadly: advertising or marketing material directed to particular individuals, “by whatever means”. So it covers email, SMS, WhatsApp and phone. A person can send a written notice asking you to stop, and you must cease processing for that purpose by the end of a 21-day period. Many businesses now honour the request immediately through an unsubscribe link. This is the simplest way to comply, and it is what inbox providers expect anyway.
3. Tell people what you do with their data
At the point of collection, people must be told who you are, why you want their data, how long you will keep it and what rights they have, including the right to complain to the Commissioner. A short notice next to your sign-up form and a clear privacy policy cover this.
4. Only send data abroad when it will be protected
Part IV of the Act says personal data should not be transferred outside Barbados unless the destination provides an adequate level of protection, or appropriate safeguards are in place. This matters because almost every email platform stores your list outside the island. See the section on hosting below.
Penalties under the Act
The Act creates criminal offences, not just administrative fines. For example, failing to comply with the core data protection principles, or transferring data abroad in breach of Part IV, can lead on summary conviction to a fine of BBD $500,000, imprisonment for up to three years, or both. At the 2:1 peg, that fine is roughly US$250,000. Smaller offences carry lower fines. Controllers must also notify personal data breaches to the Commissioner without undue delay and, where feasible, within 72 hours.
When other countries’ laws also apply
Barbadian businesses rarely market only to Barbadians. Tourism, one of the island’s main foreign-exchange earners, sells mainly to visitors from the UK, North America and the wider Caribbean, and international business firms serve clients worldwide. When your list includes people in the EU or the UK, the GDPR and the UK GDPR, together with each country’s e-privacy rules, can apply to those contacts. Canadian recipients bring CASL into play, and US recipients bring the CAN-SPAM Act. The safest approach for a mixed list is to use the strictest standard for everyone: express opt-in, clear identification and a one-click unsubscribe.
Where your list is hosted matters
Because the Barbados Act limits transfers to places with adequate protection, it makes sense to check where your email provider stores your contacts. Mailpro is hosted in Switzerland on private infrastructure, outside US jurisdiction. Switzerland is recognised by the European Union under an EU adequacy decision, so it is a strong destination to document in your records of processing. You can read more about why Switzerland is a strong choice for customer data. Mailpro is GDPR-native, encrypts connections with TLS 1.3, and never sells or rents your data.
A practical compliance checklist for Barbadian senders
- Use an unticked checkbox or a double opt-in confirmation on every sign-up form, including those at hotel check-in, events and Crop Over pop-ups.
- Record when, where and how each person subscribed.
- Put your business name and a physical address in every email footer, with a working unsubscribe link.
- Never buy or rent lists; they cannot carry valid consent.
- Sign a written processing agreement with your email provider; the Act expects controller–processor terms in writing.
- Keep a breach-response plan that can meet the 72-hour notification window.
For the specific question of whether bulk campaigns are lawful at all, read are email campaigns legal in Barbados?.